Related Issues

• crypto/x509: support Inhibit Any-policy and Policy Constraints #68484
• crypto/x509: ParseCertificate should error on invalid tag for PolicyMappings #70074 (closed)
• crypto/x509: invalid certificate policies #65990 (closed)
• crypto/x509: error parsing large ASN.1 identifiers #49678 (closed)
• x/crypto/cryptobyte: "x509: invalid key usage" error caused by strict asn1 bit string parsing #70242
• crypto/x509: parse SAN DirectoryName #47618 (closed)
• crypto/x509: potentially anomalous path building results #65085

Related Code Changes

• crypto/x509: allow parsing of certificates with unknown critical extensions.

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

AFAIK, we do not support subjectInfoAccess, and policyConstraints in the crypto/x509 parser.

@dulanshuangqiao do you have a reproducer, like a short code snippet, to demonstrate the issue, what happens and what you expect? Thanks.

cc @golang/security

@dulanshuangqiao您是否有一个重现器（例如一个简短的代码片段）来演示该问题、发生了什么以及您期望什么？谢谢。

抄送@golang/security

I have provided the program I used in the attachment. I used it to convert der to pem format. This program reported an error when processing the Authority Information Access extension marked as critical: incorrectly marked critical. So I looked up RFC5280 about Authority Information Access and found the description: Conforming CAs MUST mark this extension as non-critical.
So I continued to test other extensions with the same description, such as Subject Information Access, Policy Constraints, etc., but even if they were marked as critical, the program did not throw an error like the Authority Information Access, but successfully completed the conversion.
program.zip