crypto/x509: CheckSignatureFrom does not verify Issuer matches parent's Subject #14955
Labels
FrozenDueToAge
NeedsInvestigation
Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Comments
bradfitz
changed the title
|
/cc @agl |
quentinmit
added
the
NeedsInvestigation
|
@agl Is this important for Go 1.7? |
|
I don't believe that this warrant rushing for 1.7. |
|
Thanks for the issue and repro @jsha. I was bored this evening and decided to take a stab at this with https://go-review.googlesource.com/23571 using most of your repro in the tests. I couldn't find your email though @jsha and so far I have requested a review only from @agl. Please free free to join in. |
|
CL https://golang.org/cl/23571 mentions this issue. |
|
Per agl's comment above and his comment on the CL, postponing to 1.8. |
|
Here's the list of certificates from the Pilot CT log where the chain contains a link that needs canonicalisation before the Subject and Issuer match. It shows the common name of the certificates in that link followed by the common names of each (unexpired) leaf certificate affected by that link. There's a small number of public certificates affected, mostly by Siemens and WellsFargo's internal CAs. (The UCA root doesn't appear to be in Mozilla yet.) I'll wait for comments but, based on this, it looks viable that we would want to require a strict match of issuer/subject when checking chains. (I.e. these certificates would break.) |
|
To me, this list looks small enough that it seems reasonable to require the strict match even though these certs would not validate. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
go version)?go version go1.6 linux/amd64
go env)?GOARCH="amd64"
GOBIN="/home/jsha/gopkg/bin"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/jsha/gopkg"
GORACE=""
GOROOT="/home/jsha/go1.6"
GOTOOLDIR="/home/jsha/go1.6/pkg/tool/linux_amd64"
GO15VENDOREXPERIMENT="1"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0"
CXX="g++"
CGO_ENABLED="1"
https://play.golang.org/p/4Q5wwbag_y
Runs successfully, no errors
Per https://tools.ietf.org/html/rfc5280#page-73,
However, in the test code linked above,
ee.CheckSignatureFrom(issuer2)returns a nil error, even though the subject ofissuer2is not equal to the issuer ofee.Successfully verified signature on EE cert from issuer2, expected failure.The text was updated successfully, but these errors were encountered: