]> Cypherpunks repositories - gostls13.git/commit
crypto/x509: allow parsing of certificates with unknown critical extensions.
authorAdam Langley <agl@golang.org>
Sun, 26 Apr 2015 22:18:41 +0000 (15:18 -0700)
committerAdam Langley <agl@golang.org>
Tue, 28 Apr 2015 16:32:09 +0000 (16:32 +0000)
commitd942737f8a3b15a79d2d1252e107edeb2e51d7e5
tree6ffc8dd86fc06e31163acdf47b0b9577c5d4e80d
parent63caec5dee719d20907810b0ad5a3fe84421d77a
crypto/x509: allow parsing of certificates with unknown critical extensions.

Previously, unknown critical extensions were a parse error. However, for
some cases one wishes to parse and use a certificate that may contain
these extensions. For example, when using a certificate in a TLS server:
it's the client's concern whether it understands the critical extensions
but the server still wishes to parse SNI values out of the certificate
etc.

This change moves the rejection of unknown critical extensions from
ParseCertificate to Certificate.Verify. The former will now record the
OIDs of unknown critical extensions in the Certificate and the latter
will fail to verify certificates with them. If a user of this package
wishes to handle any unknown critical extensions themselves, they can
extract the extensions from Certificate.Extensions, process them and
remove known OIDs from Certificate.UnknownCriticalExtensions.

See discussion at
https://groups.google.com/forum/#!msg/golang-nuts/IrzoZlwalTQ/qdK1k-ogeHIJ
and in the linked bug.

Fixes #10459

Change-Id: I762521a44c01160fa0901f990ba2f5d4977d7977
Reviewed-on: https://go-review.googlesource.com/9390
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
src/crypto/x509/verify.go
src/crypto/x509/x509.go
src/crypto/x509/x509_test.go