diff options
| author | Patryk Chelmecki <pat.chelmecki@gmail.com> | 2023-05-17 20:48:28 +0000 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2023-05-17 21:01:16 +0000 |
| commit | f0de4b4f03cdde77305b7ae14bd960130a855182 (patch) | |
| tree | 4735e38aa848478047ace389f6b62b29d2518551 /src/internal/syscall/unix/nonblocking_wasip1.go | |
| parent | a1674f3ee30bf46d22fcac115529ce830f8c9ac9 (diff) | |
| download | go-git-f0de4b4f03cdde77305b7ae14bd960130a855182.tar.gz | |
crypto/x509: fix certificate validation with FQDN on Windows
Currently certificate verification on Windows fails if the provided dns name ends with a dot (which means it is a Fully Qualified Domain Name). The certificates according to RFC 6066 (https://www.rfc-editor.org/rfc/rfc6066#section-3) do not contain that ending dot. Go uses CertVerifyCertificateChainPolicy Windows system call with CERT_CHAIN_POLICY_SSL option for verification of the certificates. That call fails if the specified domain name contains the dot at the end.
Examples of other open source codebases that use the same system call and trim the trailing dot before executing it:
MongoDb - https://github.com/mongodb/mongo/blob/master/src/mongo/util/net/ssl_manager_windows.cpp#L1777
Dot Net - https://github.com/dotnet/runtime/blob/v7.0.5/src/libraries/System.Net.Security/src/System/Net/Security/SslAuthenticationOptions.cs#L52
Change-Id: I5db558eb277cf00f5401ec0ffc96c935023ad100
GitHub-Last-Rev: cc69ab9be35f79a93279bd618912a3fd6aaa9f88
GitHub-Pull-Request: golang/go#59846
Reviewed-on: https://go-review.googlesource.com/c/go/+/489135
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Patryk Chełmecki <patchelmecki@google.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/internal/syscall/unix/nonblocking_wasip1.go')
0 files changed, 0 insertions, 0 deletions