by tav@espians.com:

There is an issue with the TLS certifcate verification mechanism. Trying to connect to
say
https://ampifyit.appspot.com (Google App Engine) with:

    cxn, _ := tls.Dial("tcp", "", "ampifyit.appspot.com:443")
    _, err := cxn.Write([]byte("GET / HTTP/1.1\r\n\r\n"))

    if err != nil {
        fmt.Printf("%s\n", err)
    }

Will result in the connection failing with a bad certificate alert:

    local error: bad certificate

The problem is caused by the following line in crypto/tls/ca_set:

        func (s *CASet) FindParent(cert *x509.Certificate) (parent *x509.Certificate) {
            if len(cert.AuthorityKeyId) > 0 {
=>              return s.bySubjectKeyId[string(cert.AuthorityKeyId)]
            }
            return s.byName[nameToKey(&cert.Issuer)]
        }

That is, it fails to find a match for the Authority Key Identifier in the CA set's
Subject Key Identifier -> Root Certificate mapping.

I'm slightly lost as to why it's happening. The certificate chain looks like:

    *.appspot.com
    Google Internet Authority
    Equifax Secure Certificate Authority

I initially thought that the problem might be due to the intermediate certificate, but
that doesn't seem to be the issue. The code seems to pass along the last certificate
in the received chain to the FindParent() call, and it works fine when the function
uses just the byName lookup:

  US/Equifax/Equifax Secure Certificate Authority

The issue seems to be when the CASet is parsed and loaded using SetFromPEM(). The
SubjectKeyId for the Equifax certificate in question doesn't match up.

It returns:

    04:14:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

When it should be:

    48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

I have no idea where the leading 04:14 appears from.

I'm guessing that the issue is somewhere in x509.parseCertificate()?

Or, perhaps, with the formatting of the CURL CA bundle that's used on OS X 10.5?
The ASCII matches up though...

            X509v3 Authority Key Identifier: 
                keyid:48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

            X509v3 Subject Key Identifier: 
                48:E6:68:F9:2B:D2:B2:95:D7:47:D8:23:20:10:4F:33:98:90:9F:D4

Anyways, sorry to not be of more help — my ASN.1-fu is non-existent =(

Let me know if there's any other info I could provide.

-- Cheers, tav