Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: CANotAuthorizedForExtKeyUsage is a bogus error [1.10 backport] #25258

Closed
gopherbot opened this issue May 4, 2018 · 2 comments
Closed

crypto/x509: CANotAuthorizedForExtKeyUsage is a bogus error [1.10 backport] #25258

gopherbot opened this issue May 4, 2018 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Milestone
Go1.10.3

Comments

@gopherbot
Copy link

@FiloSottile requested issue #24590 to be considered for backport to the next 1.10 minor release.

Based on discussion with @agl, we will go back to only enforcing nesting (and returning CANotAuthorizedForExtKeyUsage) when the EKU is being asserted in Verify.

@gopherbot, please open a tracking issue for backporting to 1.10.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 4, 2018
@gopherbot gopherbot mentioned this issue May 4, 2018
Closed
@gopherbot gopherbot added this to the Go1.10.3 milestone May 4, 2018
cholick added a commit to vmware-archive/kibosh that referenced this issue May 16, 2018
@cholick
Downgrade to Golang 1.9 due to ssl issue
4562057 
See:
golang/go#24590
golang/go#25258
@gopherbot
Copy link
Author

Change https://golang.org/cl/114035 mentions this issue: [release-branch.go1.10] crypto/x509: check EKUs like 1.9.

@gopherbot
Copy link
Author

Closed by merging 09fa131 to release-branch.go1.10.

gopherbot pushed a commit that referenced this issue May 24, 2018
@agl @FiloSottile
[release-branch.go1.10] crypto/x509: check EKUs like 1.9.
09fa131 
This change brings back the EKU checking from 1.9. In 1.10, we checked
EKU nesting independent of the requested EKUs so that, after verifying a
certifciate, one could inspect the EKUs in the leaf and trust them.

That, however, was too optimistic. I had misunderstood that the PKI was
/currently/ clean enough to require that, rather than it being
desirable. Go generally does not push the envelope on these sorts of
things and lets the browsers clear the path first.

Fixes #25258

Change-Id: I18c070478e3bbb6468800ae461c207af9e954949
Reviewed-on: https://go-review.googlesource.com/113475
Reviewed-by: Filippo Valsorda <filippo@golang.org>
(cherry picked from commit 180e0f8a1b149bd1d15df29b6527748266cacad9)
Reviewed-on: https://go-review.googlesource.com/114035
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Andrew Bonventre <andybons@golang.org>
@golang golang locked and limited conversation to collaborators May 24, 2019
@dmitshur dmitshur added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels Dec 5, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge
Projects
None yet
Milestone
Go1.10.3
Development

No branches or pull requests
2 participants
@dmitshur @gopherbot