Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: Fails to parse certificates with fully qualified domain names #24070

Closed
hanikesn opened this issue Feb 23, 2018 · 2 comments
Closed

crypto/x509: Fails to parse certificates with fully qualified domain names #24070

hanikesn opened this issue Feb 23, 2018 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Comments

@hanikesn
Copy link

After recompiling our code with 1.10 it fails to parse certificates including fully qualified domain names (with a . at the end).

tls: failed to parse certificate from server: x509: cannot parse dnsName "master.test.local."

This seems to be related to #23995 and introduced by: #15196
@ianlancetaylor ianlancetaylor added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Feb 23, 2018
@ianlancetaylor ianlancetaylor added this to the Go1.10.1 milestone Feb 23, 2018
@ianlancetaylor
Copy link
Contributor

CC @FiloSottile @agl

@FiloSottile
Copy link
Contributor

Trailing dots are not allowed in dnsName, so this is a duplicate of #23711 since the dnsName issue is in the leaf. However, it would be fixed by the #23995 patch, because it would only invoke parsing when checking name constraints, so I'll count it as a +1 on there. (I do wonder why matchHostnames supports them.)

From RFC 5280:

The name MUST be in the "preferred name syntax", as specified by
Section 3.5 of [RFC1034] and as modified by Section 2.1 of
[RFC1123].

@FiloSottile FiloSottile changed the title crypto/x509 1.10: Fails to parse certificates with fully qualified domain names crypto/x509: Fails to parse certificates with fully qualified domain names Feb 23, 2018
@andybons andybons removed this from the Go1.10.1 milestone Mar 26, 2018
@golang golang locked and limited conversation to collaborators Mar 26, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@andybons @hanikesn @FiloSottile @ianlancetaylor @gopherbot