-
Notifications
You must be signed in to change notification settings - Fork 18k
crypto/x509: ParseCertificate fails for ECDSA certificate, gives asn1 unmarshal error #21502
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Your cert looks fishy. Replacing it with another one (ECDSA too, of course) leads to successful decoding. |
These are the commands we used to generate the cert:
It looks like the |
when parsing an ECDSA certificate, improve the error message upon failing to parse the curve as a named curve, rather than returning the original ASN1 error. Fixes golang#21502 (sort of, to the extent that it needs fixing)
Go assumes that an ECDSA curve as specified in a certificate is always going to be a named curve. Named curves are only one of 3 valid ways of specifying a curve, according to RFC 5480, but the only way to do so for x.509 certificates:
The failing certificate uses
|
https://go-review.googlesource.com/c/57050 makes a more useful error message here. |
Change https://golang.org/cl/57050 mentions this issue: |
Please answer these questions before submitting your issue. Thanks!
What version of Go are you using (
go version
)?go version go1.8.3 darwin/amd64
What operating system and processor architecture are you using (
go env
)?What did you do?
Decoding ECDSA certificate (fail)
https://play.golang.org/p/wHYxSA6JrN
Note: decoding this certificate using
openssl x509 -in devCA.crt -text -noout
produces correct output.Decoding RSA certificate (success)
https://play.golang.org/p/fvcX76vbY5
What did you expect to see?
Return
ok=true
fromcertPool.AppendCertsFromPEM
on decoding ECDSA certificateWhat did you see instead?
The text was updated successfully, but these errors were encountered: