Disable x509 serial number validation #3277
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
adreed-msft
requested review from
dphulkar-msft,
gapra-msft,
seanmcc-msft,
souravgupta-msft,
tanyasethi-msft,
vibhansa-msft and
wonwuakpa-msft
as code owners
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds a godebug directive to the go.mod file to enable the x509negativeserial=1 setting, which controls how negative serial numbers in X.509 certificates are handled.
Key Changes
- Added a
godebugblock with thex509negativeserial=1setting to maintain compatibility with X.509 certificates that have negative serial numbers
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
5 tasks
Member
|
Thanks for starting the discussion here. I don’t think we should add this to go.mod - MITM proxy is using negative serials, which isn’t RFC-compliant, so I'd prefer to avoid allowing something that isn't RFC compliant by default. Let’s just document how to set GODEBUG=x509negativeserial=1 instead for folks who need it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Feature / Bug Fix:
In Go 1.23, a new feature was introduced in the crypto/x509 package that disabled certificates with a negative serial number, sometimes breaking mitm proxies, which prove useful in debugging.
There is no way to disable this at runtime outside of setting the GODEBUG environment variable-- This is often above user's heads, but it's arguable that, anybody going out of their way to use a MITM proxy probably is technically inclined enough to figure out that this changed.
Hence, this isn't the cleanest solution, and I'm not the happiest with it. This PR is here to serve as a discussion point, not necessarily something to review.
Related Links:
Type of Change
How Has This Been Tested?
Manually tested behind fiddler