crypto/x509: better debug output for verify-cert calls

Now that pkix.Name offers String() we should use that as some CN's are blank.

Updates #24084

Change-Id: I268196f04b98c2bd4d5d0cf1fecd2c9bafeec0f1
Reviewed-on: https://go-review.googlesource.com/121357
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/crypto/x509/root_darwin.go b/src/crypto/x509/root_darwin.go
index bc35a1cf212e5e0faa9e7754f48c4bd8d8c8ec88..9d7b3a6ffb6cc6977373d1f3d055e11353d8de5f 100644 (file)
--- a/src/crypto/x509/root_darwin.go
+++ b/src/crypto/x509/root_darwin.go
@@ -181,12 +181,12 @@ func verifyCertWithSystem(block *pem.Block, cert *Certificate) bool {
        }
        if err := cmd.Run(); err != nil {
                if debugExecDarwinRoots {
-                       println(fmt.Sprintf("crypto/x509: verify-cert rejected %s: %q", cert.Subject.CommonName, bytes.TrimSpace(stderr.Bytes())))
+                       println(fmt.Sprintf("crypto/x509: verify-cert rejected %s: %q", cert.Subject, bytes.TrimSpace(stderr.Bytes())))
                }
                return false
        }
        if debugExecDarwinRoots {
-               println(fmt.Sprintf("crypto/x509: verify-cert approved %s", cert.Subject.CommonName))
+               println(fmt.Sprintf("crypto/x509: verify-cert approved %s", cert.Subject))
        }
        return true
 }