crypto/x509: CertificateRequest does not support attributes not covered by pkix.AttributeTypeAndValueSET #15995
Labels
NeedsInvestigation
Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Comments
ianlancetaylor
changed the title
|
CC @agl |
groob
added a commit
to groob/scep
that referenced
this issue
Jul 9, 2017
x509util.CreateCertificateRequest wraps x509.CreateCertificateRequest and adds support for challengePassword attribute. Adding a new attribute means re-signing the whole CSR, which means importing private methods and types from the x509 package. I hope to eventually submit a CL to the stdlib. Go Issue: golang/go#15995
groob
added a commit
to groob/scep
that referenced
this issue
Jul 9, 2017
x509util.CreateCertificateRequest wraps x509.CreateCertificateRequest and adds support for challengePassword attribute. Adding a new attribute means re-signing the whole CSR, which means importing private methods and types from the x509 package. I hope to eventually submit a CL to the stdlib. Go Issue: golang/go#15995 For micromdm#44.
groob
added a commit
to groob/scep
that referenced
this issue
Jul 9, 2017
x509util.CreateCertificateRequest wraps x509.CreateCertificateRequest and adds support for challengePassword attribute. Adding a new attribute means re-signing the whole CSR, which means importing private methods and types from the x509 package. I hope to eventually submit a CL to the stdlib. Go Issue: golang/go#15995 For micromdm#44. For micromdm#22.
groob
added a commit
to groob/scep
that referenced
this issue
Jul 9, 2017
x509util.CreateCertificateRequest wraps x509.CreateCertificateRequest and adds support for challengePassword attribute. Adding a new attribute means re-signing the whole CSR, which means importing private methods and types from the x509 package. I hope to eventually submit a CL to the stdlib. Go Issue: golang/go#15995 For micromdm#44. For micromdm#22.
groob
added a commit
to micromdm/scep
that referenced
this issue
Jul 9, 2017
x509util.CreateCertificateRequest wraps x509.CreateCertificateRequest and adds support for challengePassword attribute. Adding a new attribute means re-signing the whole CSR, which means importing private methods and types from the x509 package. I hope to eventually submit a CL to the stdlib. Go Issue: golang/go#15995 For #44. For #22.
|
Hi, Do we have any update on this? |
seankhliao
added
the
NeedsInvestigation
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Prior to Go 1.5 it was not possible to parse CSRs which included single attributes like challenge password( OID 1.2.840.113549.1.9.7) See cloudflare/cfssl#115
This issue was addressed in CL #8160 cloudflare/go@23fca3d by ignoring those attributes.
Currently there is no good way to parse and marshal a CSR with attributes that don't fit in the structure defined by
pkix.AttributeTypeAndValueSET. Challenge Password is a necessary attribute when implementing the SCEP Protocol which is widely used in IoT and Mobile Device Management environments like the Apple MDM spec.To extract or add a challenge password attribute, the CSR has to be unmarshalled and modified separately from the
x509/crypto. Here's an example workaround which reimplements parsing and marshaling the CertificateRequest type.The
x509/cryptolibrary should have a method for handling special attributes in the CSR. As CL #8160 mentions in the review comments, one possible solution is to add aRawAttributesfield to the CertificateRequest struct.The text was updated successfully, but these errors were encountered: