From 4c71af71b43f8fcface5f63cdb3620203b58d45e Mon Sep 17 00:00:00 2001 From: Martin Kreichgauer Date: Fri, 9 Dec 2016 11:29:52 -0800 Subject: [PATCH] crypto/x509: marshal certificate revocation times in UTC (Zulu time). This is required by RFC 5280. Fixes #16686 Change-Id: I291c68dd97410a4f7ae7c4e524b91a2493ac50a9 Reviewed-on: https://go-review.googlesource.com/34245 Reviewed-by: Brad Fitzpatrick Run-TryBot: Brad Fitzpatrick TryBot-Result: Gobot Gobot --- src/crypto/x509/x509.go | 9 ++++++++- src/crypto/x509/x509_test.go | 24 +++++++++++++++++++++--- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go index d9077db653..949ce01856 100644 --- a/src/crypto/x509/x509.go +++ b/src/crypto/x509/x509.go @@ -1850,13 +1850,20 @@ func (c *Certificate) CreateCRL(rand io.Reader, priv interface{}, revokedCerts [ return nil, err } + // Force revocation times to UTC per RFC 5280. + revokedCertsUTC := make([]pkix.RevokedCertificate, len(revokedCerts)) + for i, rc := range revokedCerts { + rc.RevocationTime = rc.RevocationTime.UTC() + revokedCertsUTC[i] = rc + } + tbsCertList := pkix.TBSCertificateList{ Version: 1, Signature: signatureAlgorithm, Issuer: c.Subject.ToRDNSequence(), ThisUpdate: now.UTC(), NextUpdate: expiry.UTC(), - RevokedCertificates: revokedCerts, + RevokedCertificates: revokedCertsUTC, } // Authority Key Id diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go index 354545ccbc..aa30d85b7d 100644 --- a/src/crypto/x509/x509_test.go +++ b/src/crypto/x509/x509_test.go @@ -850,17 +850,31 @@ func TestCRLCreation(t *testing.T) { block, _ = pem.Decode([]byte(pemCertificate)) cert, _ := ParseCertificate(block.Bytes) - now := time.Unix(1000, 0) + loc := time.FixedZone("Oz/Atlantis", int((2 * time.Hour).Seconds())) + + now := time.Unix(1000, 0).In(loc) + nowUTC := now.UTC() expiry := time.Unix(10000, 0) revokedCerts := []pkix.RevokedCertificate{ { SerialNumber: big.NewInt(1), + RevocationTime: nowUTC, + }, + { + SerialNumber: big.NewInt(42), + // RevocationTime should be converted to UTC before marshaling. RevocationTime: now, }, + } + expectedCerts := []pkix.RevokedCertificate{ + { + SerialNumber: big.NewInt(1), + RevocationTime: nowUTC, + }, { SerialNumber: big.NewInt(42), - RevocationTime: now, + RevocationTime: nowUTC, }, } @@ -869,10 +883,14 @@ func TestCRLCreation(t *testing.T) { t.Errorf("error creating CRL: %s", err) } - _, err = ParseDERCRL(crlBytes) + parsedCRL, err := ParseDERCRL(crlBytes) if err != nil { t.Errorf("error reparsing CRL: %s", err) } + if !reflect.DeepEqual(parsedCRL.TBSCertList.RevokedCertificates, expectedCerts) { + t.Errorf("RevokedCertificates mismatch: got %v; want %v.", + parsedCRL.TBSCertList.RevokedCertificates, expectedCerts) + } } func fromBase64(in string) []byte { -- 2.50.0