crypto/x509

ParseCertificate allows unsorted `SET` values in RDNsBugReportNeedsInvestigation

#73743 opened 1 week ago by printfn

ExtKeyUsageAny bypasses policy validation [1.24 backport]CherryPickApprovedSecurity

#73700 opened 1 week ago by gopherbot

ParseCRL allows CRL files to have duplicate revoked entries and duplicate certificate serial numbers.BugReportNeedsInvestigation

#73452 opened 1 month ago by onepeople158

ParseCRL allows the Invalidity Date of revoked certificates in the CRL to be UTC timeBugReportNeedsInvestigation

#73442 opened 1 month ago by onepeople158

ParseCRL allows revocation serial number that is a non-positive integerBugReportNeedsInvestigation

#73433 opened 1 month ago by onepeople158

ParseRevocationList accepts having both onlyContainsUserCerts and onlyContainsCACerts set to trueBugReportNeedsInvestigation

#73308 opened 1 month ago by onepeople158

ParseRevocationList accepts authorityCertSerialNumber set to 0BugReportNeedsInvestigation

#73293 opened 1 month ago by onepeople158

Go parsed a GeneralName with an incorrect tagBugReportNeedsInvestigation

#73285 opened 1 month ago by onepeople158

Go accepts the IDP extension with DER encoding as an empty sequenceBugReportNeedsInvestigation

#73284 opened 1 month ago by onepeople158

ParseCertificate fails to parse certificates with a compressed EC public keyBugReportNeedsInvestigation

#73142 opened 1 month ago by austin-jadlowiec

ParseRevocationList accepts two AKI extensionsNeedsInvestigation

#73051 opened 2 months ago by onepeople158

ParseRevocationList accepts invalid AKI extension in CRLBugReportNeedsInvestigation

#73030 opened 2 months ago by onepeople158

ParseRevocationList incorrect handling of the CRL Number fieldBugReportNeedsInvestigation

#73029 opened 2 months ago by onepeople158

accepts DN with all empty valuesNeedsInvestigation

#73021 opened 2 months ago by onepeople158

allows country name fields longer than 2 charsBugReportNeedsInvestigation

#73020 opened 2 months ago by onepeople158

accepts invalid thisUpdate UTCTimes without secondsBugReportNeedsInvestigation

#73019 opened 2 months ago by onepeople158

allow user override of the system roots on all platformsLibraryProposalProposalProposal-Crypto

#71924 opened 2 months ago by Snaipe

Encode & decode ECDH only works for 1 out of 4 curves; P256, P384, P521 not workingBugReportNeedsDecision

#71919 opened 3 months ago by justincranford

Verify should reject certificates with empty issuersBugReportNeedsInvestigation

#71832 opened 3 months ago by dulanshuangqiao

support systemVerify with p11-kitLibraryProposalProposalProposal-Crypto

#71799 opened 3 months ago by terinjokes

should error if non-CA certificate contains name constraintsBugReportNeedsInvestigation

#71795 opened 3 months ago by dulanshuangqiao

incorrect user trust store directory is used for AndroidBugReportNeedsInvestigationOS-Androidmobile

#71258 opened 4 months ago by chenxiaolong

support for RFC 9336 Document Signing EKUProposalProposal-Crypto

#70825 opened 5 months ago by elear

support extracting X25519 public keys from certificatesProposalProposal-Crypto

#70667 opened 5 months ago by EdSchouten

certificate with empty Authority Key Identifier extension considered invalidNeedsInvestigation

#70619 opened 5 months ago by dulanshuangqiao

parser should error on Subject Information Access and Policy Constraints being makred as criticalNeedsInvestigation

#70278 opened 6 months ago by dulanshuangqiao

malformed signature algorithm identifier error while version and serialNumber swappedNeedsInvestigation

#70269 opened 6 months ago by dulanshuangqiao

no support for BitStringNeedsInvestigation

#69463 opened 8 months ago by TxI5

unrecognized failuresNeedsInvestigation

#68803 opened 9 months ago by gopherbot

Get "https://google.com": tls: failed to verify certificate: SecPolicyCreateSSL error: 0 when running in child after parent exitsNeedsInvestigationOS-Darwin

#68557 opened 10 months ago by NorseGaud

TestPlatformVerifierLegacy/expired_leaf failuresNeedsInvestigation

#67994 opened 11 months ago by gopherbot

TestPlatformVerifierLegacy/wrong_host_for_leaf failuresNeedsInvestigation

#67993 opened 11 months ago by gopherbot

TestPlatformVerifierLegacy/self-signed_leaf failuresNeedsInvestigation

#67992 opened 11 months ago by gopherbot

add sentinel errorsProposalProposal-Crypto

#67338 opened 1 year ago by MadsRC

Certificate.isValid should reject certificates with UnknownPublicKeyAlgorithmNeedsInvestigation

#66167 opened 1 year ago by rolandshoemaker

check Certificate.isValid on CertPool.AddNeedsInvestigation

#66166 opened 1 year ago by rolandshoemaker

TestPlatformVerifierLegacy failuresNeedsInvestigationSecurity

#65626 opened 1 year ago by gopherbot

potentially anomalous path building resultsNeedsInvestigationSecurity

#65085 opened 1 year ago by woodruffw

relax boringcrypto certificate key size restrictions given the ongoing FIPS 140-3 validationNeedsInvestigation

#65042 opened 1 year ago by HakanSunay

Allow to pass flags to syscall.CertGetCertificateChain, when using TLS Transport under WindowsNeedsInvestigationOS-WindowsProposalProposal-Crypto

#63238 opened 2 years ago by jkroepke

TestPlatformVerifierLegacy failuresNeedsInvestigation

#62912 opened 2 years ago by gopherbot

AKI (Authority Key Id) exclusion logic is brokenNeedsInvestigation

#62060 opened 2 years ago by furkanmustafa

remove x509sha1 GODEBUG in Go 1.24Proposal

#62048 opened 2 years ago by rsc

add Context to VerifyOptionsProposalProposal-Crypto

#61576 opened 2 years ago by rolandshoemaker

RevocationList.CheckSignatureFrom doesn't check SubjectNeedsInvestigation

#60728 opened 2 years ago by thierry-f-78

Add support for PKCS#10 attributesProposalProposal-Crypto

#60718 opened 2 years ago by dachaac

CreateRevocationList over-enforces KeyUsage checkNeedsInvestigation

#59669 opened 2 years ago by cipherboy

ParseCertificate should mention the ownership of the slice passed to it.DocumentationNeedsInvestigation

#59548 opened 2 years ago by mateusz834

Certificate.Verify rejects self-signed leafNeedsInvestigation

#58792 opened 2 years ago by rittneje

Certificate.Verify does not consistently return UnknownAuthorityErrorNeedsInvestigation

#58777 opened 2 years ago by rittneje

stop using math/big and crypto/elliptic for parsingNeedsFix

#58635 opened 2 years ago by FiloSottile

support SCT/OCSP passthrough when using platform verifiersProposalProposal-AcceptedProposal-Crypto

#58251 opened 2 years ago by rolandshoemaker

TestPlatformVerifier/revoked_leaf fails on macOS 13.1NeedsInvestigationOS-Darwin

#57428 opened 2 years ago by dmitshur

add String() for KeyUsage, ExtKeyUsageProposalProposal-AcceptedProposal-Crypto

#56866 opened 2 years ago by izolight

HTTP POST to Italian government web service fails with "x509: unhandled critical extension" error on Linux hostNeedsInvestigation

#55872 opened 2 years ago by genesio-systemlogic

Verification of ECDSA signed x509 cert, sanitized to LowS certs fails verification with go 1.19NeedsInvestigation

#54549 opened 2 years ago by C0rWin

SIGILL illegal instruction on result of `go install`NeedsInvestigationOS-Darwin

#53841 opened 2 years ago by hherman1

pkix.Name.String() does not preserve correct order NeedsInvestigation

#52462 opened 3 years ago by bjanders

come up with better solution for testing platform verifiersBuildersNeedsFix

#52108 opened 3 years ago by rolandshoemaker

VerifyOptions.Roots does not enforce that certificates are root certificatesNeedsDecision

#51953 opened 3 years ago by haydentherapper

malformed x509 certificate is accepted since 1.17NeedsDecision

#51369 opened 3 years ago by bitmingw

wrong result checking signature of CSR with unordered multi-value RDNNeedsDecision

#49519 opened 3 years ago by defacto64

unable to parse Attribute CertificateNeedsInvestigation

#49270 opened 3 years ago by salrashid123

invalid RDNSequence: invalid attribute value: unsupported string type: 4NeedsInvestigation

#48371 opened 3 years ago by c00w

unable to parse certificate with rsassa-pss algorithmNeedsInvestigation

#48314 opened 3 years ago by jpduckwo

inner and outer signature algorithm identifiers don't matchNeedsInvestigation

#47689 opened 3 years ago by groob

support OIDs for tcg-kp (2.23.133.8)NeedsInvestigation

#47620 opened 3 years ago by tracefinder

add a PKITS testNeedsFixTestinghelp wanted

#45857 opened 4 years ago by FiloSottile

store stripped down trust anchorsNeedsInvestigation

#44298 opened 4 years ago by rolandshoemaker

Export wrong parse function errorProposalProposal-Crypto

#43780 opened 4 years ago by joeshaw

ParseCertificate and ParseCertificates return different errors with a single bad certificate suppliedNeedsInvestigation

#43113 opened 4 years ago by LujunWeng

add ability to reload root certificatesFeatureRequestNeedsDecisionProposal-Crypto

#41888 opened 4 years ago by dtoubelis

check the Key Usage extensionNeedsFix

#40100 opened 4 years ago by FiloSottile

implement OCSP verifierProposalProposal-CryptoProposal-Hold

#40017 opened 4 years ago by FiloSottile

Trust relationship of certs returned by 'x509.SystemCertPool()' is ambiguousNeedsInvestigation

#39540 opened 5 years ago by stephen-fox

make CertPool.contains publicProposalProposal-Crypto

#39179 opened 5 years ago by stephen-fox

stop looking at first root storeNeedsFix

#38869 opened 5 years ago by FiloSottile

failed to parse Intermediate CA certificateNeedsInvestigation

#38737 opened 5 years ago by sebastien-rosset

support policyQualifiers in certificatePolicies extensionNeedsInvestigation

#38116 opened 5 years ago by rolandshoemaker

certificate validation in Windows fails to validate IP in SANNeedsInvestigationOS-Windows

#37176 opened 5 years ago by ihgann

reloading certificates from diskProposalProposal-Crypto

#35887 opened 5 years ago by wking

select a certificate store for systemVerify on WindowsNeedsInvestigationOS-Windows

#34977 opened 5 years ago by SeanBurford

ability to add custom curve when parsing X509 certificateProposalProposal-CryptoProposal-Hold

#32874 opened 5 years ago by trung

unexpected name mismatch errorNeedsInvestigationUnfortunate

#31440 opened 6 years ago by sneis

ObjectIdentifier and ParseCertificate do not support int > 31 bits, preventing support of OID 2.25 (/UUID) (follow-up on #19933)NeedsInvestigation

#30757 opened 6 years ago by vpelletier

RSAES-OAEP supportFeatureRequestNeedsInvestigation

#30416 opened 6 years ago by DenisKarch

DN OU orderingNeedsInvestigation

#29040 opened 6 years ago by rikkuness

verify checks root certificateNeedsInvestigation

#28971 opened 6 years ago by vit3k

reduce memory usage when parsing system root certs?NeedsInvestigationPerformance

#26731 opened 6 years ago by bradfitz

ensure CreateCertificate won't generate unparsable certificatesNeedsFixTestinghelp wanted

#24156 opened 7 years ago by FiloSottile

Provide a mechanism for accessing SRVNamesProposalProposal-AcceptedProposal-Crypto

#21789 opened 7 years ago by SamWhited

AKI is left blank even for non-self-signed cert when subject matches CA's subject fieldNeedsInvestigation

#20002 opened 8 years ago by mikesmitty

CertificateRequest does not support attributes not covered by pkix.AttributeTypeAndValueSETNeedsInvestigation

#15995 opened 9 years ago by groob

support DirectoryName name constraintsFeatureRequestNeedsDecision

#15196 opened 9 years ago by vanbroup

no support for parsing encrypted PKCS8 private keysFeatureRequest

#8860 opened 10 years ago by gopherbot

add more detail to the error message arising from a missing hash function.NeedsFixhelp wanted

#7735 opened 11 years ago by agl