]> Cypherpunks repositories - gostls13.git/commit
[release-branch.go1.11] crypto/x509: consider parents by Subject if AKID has no match
authorFilippo Valsorda <filippo@golang.org>
Mon, 4 Feb 2019 23:08:43 +0000 (18:08 -0500)
committerFilippo Valsorda <filippo@golang.org>
Tue, 26 Feb 2019 01:57:55 +0000 (01:57 +0000)
commitaa95a1eb5a3423d96873946d47c663bdc8f3565e
tree11208ffe3798ca9360bfd6ef61267a1ffb4945a1
parentc8c897a67066ef9e6011933ea5fead3bfa6b2333
[release-branch.go1.11] crypto/x509: consider parents by Subject if AKID has no match

If a certificate somehow has an AKID, it should still chain successfully
to a parent without a SKID, even if the latter is invalid according to
RFC 5280, because only the Subject is authoritative.

This reverts to the behavior before #29233 was fixed in 770130659. Roots
with the right subject will still be shadowed by roots with the right
SKID and the wrong subject, but that's been the case for a long time, and
is left for a more complete fix in Go 1.13.

Updates #30079
Fixes #30081

Change-Id: If8ab0179aca86cb74caa926d1ef93fb5e416b4bb
Reviewed-on: https://go-review.googlesource.com/c/161097
Reviewed-by: Adam Langley <agl@golang.org>
(cherry picked from commit 95e5b07cf5fdf3352f04f5557df38f22c55ce8e8)
Reviewed-on: https://go-review.googlesource.com/c/163739
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
src/crypto/x509/cert_pool.go
src/crypto/x509/verify_test.go