Could you provide us a Go snippet that reproduces the bug? Given the fact that Go maintainers are not necessarily familiar with the other codebases you have cross linked to, It is hard to go through the other issues and being able to reproduce the case.

@rakyll Puh. I understand your request, but unfortunately I'm not a go-developer. Maybe @ayufan can help us here.

And I fear we/the developer needs to setup:

Client:

• Requested Code Snippet

Server

• some small HTTPS-webserver
• SSL-Certificate Chain - relatively easy to setup with XCA

I can help with CA. To open the CA database the developer needs to download XCA and open/export the certificates from there. The given CA file contains 4 CAs and 2 server certificates. One is for server.example.com and the other is for *.example.com. I hope it's ok to add some binary file to that issue, but it's the most convient way to re-use my work.

You can find the files for the CA here. It's a data repository hosted with Github Pages. Unfortunately I was not able to add the files to this issue. The most relevant file is the ca.xdb-file. It contains the CA database.

Added link to the CA.

Setup apache (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04):

Listen 443
<VirtualHost *:443>
    ServerName server.example.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/server.example.com.crt
    SSLCertificateKeyFile /etc/ssl/private/server.example.com.key
</VirtualHost>

Ok. @rakyll I prepared a docker image you can use if you like. It contains "just" the webservers "nginx" and "apache" setup with ssl. Please see https://github.com/fedux-org/centos-webservers for detailed instructions about how to use it.

docker pull feduxorg/centos-webservers

I put together "some kind" of a client via google and C&P. Unfortunately I cannot reproduce the issue with it. :-(

@ayufan Do you do something different in gitlab-ci-runner or use some other library?

package main

import (
  "crypto/tls"
  "crypto/x509"
  "log"
  "fmt"
  "net/http"
  "io/ioutil"
  "os"
    )
func main() {

  var caFile = "/etc/ca-certificates/trust-source/anchors/CA_Example_Com.crt"

  // Load CA cert
  caCert, err := ioutil.ReadFile(caFile)
  if err != nil {
    log.Fatal(err)
  }

  caCertPool := x509.NewCertPool()
  caCertPool.AppendCertsFromPEM(caCert)

  // Setup HTTPS client
  tlsConfig := &tls.Config{
    RootCAs:      caCertPool,
  }

  tlsConfig.BuildNameToCertificate()
  transport := &http.Transport{TLSClientConfig: tlsConfig}
  client := &http.Client{Transport: transport}

  response, err := client.Get("https://localhost:8443/")
  if err != nil {
    fmt.Printf("%s", err)
    os.Exit(1)
  } else {
    defer response.Body.Close()
    contents, err := ioutil.ReadAll(response.Body)
    if err != nil {
      fmt.Printf("%s", err)
      os.Exit(1)
    }
    fmt.Printf("%s\n", string(contents))
  }
}

Can you post the certificate somewhere we can look at it? If you can't post it, can you email it to me (rsc@golang.org)?

Thanks.

The failing one or the one from the example? The failing one is internal unfortunately, I will as my security manager what he thinks about that.

@dg-ratiodata, any failing certificate will do. If the one from the example fails, that's fine too/ (I don't have time to go through whatever is required to fish it out of the Docker image.) Thanks.

Ok.

@dg-ratiodata any update on a copy of the failing certificate?

No. I asked them, but didn't get an info. I am going to ping them again.

Any news? FWIW, this is the sort of thing I'm looking for, except that this program succeeds: http://play.golang.org/p/aW9S8XQcNJ.

The certs in that program are the samples that you linked to earlier. They are fine as far as I can tell. It should be the case that if you paste your real certificate into the program instead, the program should fail, with an error coming back from ParseCertificates.

Note that 'BEGIN CERTIFICATE' data only contains a public key, not a private one. If you're worried about exposing the non-cryptographic details (view with openssl x509 -in foo.crt -text) publicly but are okay with emailing it to me (rsc@google.com), that's fine too.

Thanks.

Great. Will have a look. Thanks a lot for your patience.

I got this output after adding the certificates. I nailed it down to our internal root CA certificate. All other certs in the chain can be parsed. Besides that, running openssl worked fine with this certificate.

% go run parse.go
2015/12/04 10:08:30 failed to parse certificate: asn1: syntax error: sequence truncated
exit status 1

Hope to get a repsonse from our security guys soon.

CL https://golang.org/cl/17550 mentions this issue.

@rsc Wow, that was quick. Thanks for fixing this issue.