From 67924c1b602c170239eec821c3aea67b6ab682c7 Mon Sep 17 00:00:00 2001 From: Mikkel Krautz Date: Sat, 18 Aug 2012 15:50:33 -0700 Subject: [PATCH] crypto/tls: explicitly require ExtKeyUsageClientAuth for client certs If we aren't explicit about the KeyUsages, the verifier will treat the certificate as a server certificate and require it to have a ExtKeyUsageServerAuth key usage. R=golang-dev CC=golang-dev https://golang.org/cl/6453148 --- src/pkg/crypto/tls/handshake_server.go | 1 + 1 file changed, 1 insertion(+) diff --git a/src/pkg/crypto/tls/handshake_server.go b/src/pkg/crypto/tls/handshake_server.go index 76adc540c7..e5049a2f0d 100644 --- a/src/pkg/crypto/tls/handshake_server.go +++ b/src/pkg/crypto/tls/handshake_server.go @@ -211,6 +211,7 @@ FindCipherSuite: Roots: c.config.ClientCAs, CurrentTime: c.config.time(), Intermediates: x509.NewCertPool(), + KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, } for i, cert := range certs { -- 2.48.1