x509

package standard library

Go to main page

Versions in this module

go1

go1.18.10

Jan 10, 2023 GO-2024-2598GO-2025-3373GO-2025-4007GO-2025-4013GO-2025-4155GO-2025-4175

GO-2024-2598: Verify panics on certificates with an unknown public key algorithm in crypto/x509

GO-2025-3373: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

GO-2025-4007: Quadratic complexity when checking name constraints in crypto/x509

GO-2025-4013: Panic when validating certificates with DSA public keys in crypto/x509

GO-2025-4155: Excessive resource consumption when printing error string for host certificate validation in crypto/x509

GO-2025-4175: Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509

Changes in this version

+ var ErrUnsupportedAlgorithm = errors.New("x509: cannot verify signature: algorithm unimplemented")

+ var IncorrectPasswordError = errors.New("x509: decryption password incorrect")

+ func CreateCertificate(rand io.Reader, template, parent *Certificate, pub, priv any) ([]byte, error)

+ func CreateCertificateRequest(rand io.Reader, template *CertificateRequest, priv any) (csr []byte, err error)

+ func CreateRevocationList(rand io.Reader, template *RevocationList, issuer *Certificate, ...) ([]byte, error)

+ func DecryptPEMBlock(b *pem.Block, password []byte) ([]byte, error)

+ func EncryptPEMBlock(rand io.Reader, blockType string, data, password []byte, alg PEMCipher) (*pem.Block, error)

+ func IsEncryptedPEMBlock(b *pem.Block) bool

+ func MarshalECPrivateKey(key *ecdsa.PrivateKey) ([]byte, error)

+ func MarshalPKCS1PrivateKey(key *rsa.PrivateKey) []byte

+ func MarshalPKCS1PublicKey(key *rsa.PublicKey) []byte

+ func MarshalPKCS8PrivateKey(key any) ([]byte, error)

+ func MarshalPKIXPublicKey(pub any) ([]byte, error)

+ func ParseCRL(crlBytes []byte) (*pkix.CertificateList, error)

+ func ParseDERCRL(derBytes []byte) (*pkix.CertificateList, error)

+ func ParseECPrivateKey(der []byte) (*ecdsa.PrivateKey, error)

+ func ParsePKCS1PrivateKey(der []byte) (*rsa.PrivateKey, error)

+ func ParsePKCS1PublicKey(der []byte) (*rsa.PublicKey, error)

+ func ParsePKCS8PrivateKey(der []byte) (key any, err error)

+ func ParsePKIXPublicKey(derBytes []byte) (pub any, err error)

+ type CertPool struct

+ func NewCertPool() *CertPool

+ func SystemCertPool() (*CertPool, error)

+ func (s *CertPool) AddCert(cert *Certificate)

+ func (s *CertPool) AppendCertsFromPEM(pemCerts []byte) (ok bool)

+ func (s *CertPool) Subjects() [][]byte

+ type Certificate struct

+ AuthorityKeyId []byte

+ BasicConstraintsValid bool

+ CRLDistributionPoints []string

+ DNSNames []string

+ EmailAddresses []string

+ ExcludedDNSDomains []string

+ ExcludedEmailAddresses []string

+ ExcludedIPRanges []*net.IPNet

+ ExcludedURIDomains []string

+ ExtKeyUsage []ExtKeyUsage

+ Extensions []pkix.Extension

+ ExtraExtensions []pkix.Extension

+ IPAddresses []net.IP

+ IsCA bool

+ Issuer pkix.Name

+ IssuingCertificateURL []string

+ KeyUsage KeyUsage

+ MaxPathLen int

+ MaxPathLenZero bool

+ NotAfter time.Time

+ NotBefore time.Time

+ OCSPServer []string

+ PermittedDNSDomains []string

+ PermittedDNSDomainsCritical bool

+ PermittedEmailAddresses []string

+ PermittedIPRanges []*net.IPNet

+ PermittedURIDomains []string

+ PolicyIdentifiers []asn1.ObjectIdentifier

+ PublicKey any

+ PublicKeyAlgorithm PublicKeyAlgorithm

+ Raw []byte

+ RawIssuer []byte

+ RawSubject []byte

+ RawSubjectPublicKeyInfo []byte

+ RawTBSCertificate []byte

+ SerialNumber *big.Int

+ Signature []byte

+ SignatureAlgorithm SignatureAlgorithm

+ Subject pkix.Name

+ SubjectKeyId []byte

+ URIs []*url.URL

+ UnhandledCriticalExtensions []asn1.ObjectIdentifier

+ UnknownExtKeyUsage []asn1.ObjectIdentifier

+ Version int

+ func ParseCertificate(der []byte) (*Certificate, error)

+ func ParseCertificates(der []byte) ([]*Certificate, error)

+ func (c *Certificate) CheckCRLSignature(crl *pkix.CertificateList) error

+ func (c *Certificate) CheckSignature(algo SignatureAlgorithm, signed, signature []byte) error

+ func (c *Certificate) CheckSignatureFrom(parent *Certificate) error

+ func (c *Certificate) CreateCRL(rand io.Reader, priv any, revokedCerts []pkix.RevokedCertificate, ...) (crlBytes []byte, err error)

+ func (c *Certificate) Equal(other *Certificate) bool

+ func (c *Certificate) Verify(opts VerifyOptions) (chains [][]*Certificate, err error)

+ func (c *Certificate) VerifyHostname(h string) error

+ type CertificateInvalidError struct

+ Cert *Certificate

+ Detail string

+ Reason InvalidReason

+ func (e CertificateInvalidError) Error() string

+ type CertificateRequest struct

+ Attributes []pkix.AttributeTypeAndValueSET

+ DNSNames []string

+ EmailAddresses []string

+ Extensions []pkix.Extension

+ ExtraExtensions []pkix.Extension

+ IPAddresses []net.IP

+ PublicKey any

+ PublicKeyAlgorithm PublicKeyAlgorithm

+ Raw []byte

+ RawSubject []byte

+ RawSubjectPublicKeyInfo []byte

+ RawTBSCertificateRequest []byte

+ Signature []byte

+ SignatureAlgorithm SignatureAlgorithm

+ Subject pkix.Name

+ URIs []*url.URL

+ Version int

+ func ParseCertificateRequest(asn1Data []byte) (*CertificateRequest, error)

+ func (c *CertificateRequest) CheckSignature() error

+ type ConstraintViolationError struct

+ func (ConstraintViolationError) Error() string

+ type ExtKeyUsage int

+ const ExtKeyUsageAny

+ const ExtKeyUsageClientAuth

+ const ExtKeyUsageCodeSigning

+ const ExtKeyUsageEmailProtection

+ const ExtKeyUsageIPSECEndSystem

+ const ExtKeyUsageIPSECTunnel

+ const ExtKeyUsageIPSECUser

+ const ExtKeyUsageMicrosoftCommercialCodeSigning

+ const ExtKeyUsageMicrosoftKernelCodeSigning

+ const ExtKeyUsageMicrosoftServerGatedCrypto

+ const ExtKeyUsageNetscapeServerGatedCrypto

+ const ExtKeyUsageOCSPSigning

+ const ExtKeyUsageServerAuth

+ const ExtKeyUsageTimeStamping

+ type HostnameError struct

+ Certificate *Certificate

+ Host string

+ func (h HostnameError) Error() string

+ type InsecureAlgorithmError SignatureAlgorithm

+ func (e InsecureAlgorithmError) Error() string

+ type InvalidReason int

+ const CANotAuthorizedForExtKeyUsage

+ const CANotAuthorizedForThisName

+ const Expired

+ const IncompatibleUsage

+ const NameConstraintsWithoutSANs

+ const NameMismatch

+ const NotAuthorizedToSign

+ const TooManyConstraints

+ const TooManyIntermediates

+ const UnconstrainedName

+ type KeyUsage int

+ const KeyUsageCRLSign

+ const KeyUsageCertSign

+ const KeyUsageContentCommitment

+ const KeyUsageDataEncipherment

+ const KeyUsageDecipherOnly

+ const KeyUsageDigitalSignature

+ const KeyUsageEncipherOnly

+ const KeyUsageKeyAgreement

+ const KeyUsageKeyEncipherment

+ type PEMCipher int

+ const PEMCipher3DES

+ const PEMCipherAES128

+ const PEMCipherAES192

+ const PEMCipherAES256

+ const PEMCipherDES

+ type PublicKeyAlgorithm int

+ const DSA

+ const ECDSA

+ const Ed25519

+ const RSA

+ const UnknownPublicKeyAlgorithm

+ func (algo PublicKeyAlgorithm) String() string

+ type RevocationList struct

+ ExtraExtensions []pkix.Extension

+ NextUpdate time.Time

+ Number *big.Int

+ RevokedCertificates []pkix.RevokedCertificate

+ SignatureAlgorithm SignatureAlgorithm

+ ThisUpdate time.Time

+ type SignatureAlgorithm int

+ const DSAWithSHA1

+ const DSAWithSHA256

+ const ECDSAWithSHA1

+ const ECDSAWithSHA256

+ const ECDSAWithSHA384

+ const ECDSAWithSHA512

+ const MD2WithRSA

+ const MD5WithRSA

+ const PureEd25519

+ const SHA1WithRSA

+ const SHA256WithRSA

+ const SHA256WithRSAPSS

+ const SHA384WithRSA

+ const SHA384WithRSAPSS

+ const SHA512WithRSA

+ const SHA512WithRSAPSS

+ const UnknownSignatureAlgorithm

+ func (algo SignatureAlgorithm) String() string

+ type SystemRootsError struct

+ Err error

+ func (se SystemRootsError) Error() string

+ func (se SystemRootsError) Unwrap() error

+ type UnhandledCriticalExtension struct

+ func (h UnhandledCriticalExtension) Error() string

+ type UnknownAuthorityError struct

+ Cert *Certificate

+ func (e UnknownAuthorityError) Error() string

+ type VerifyOptions struct

+ CurrentTime time.Time

+ DNSName string

+ Intermediates *CertPool

+ KeyUsages []ExtKeyUsage

+ MaxConstraintComparisions int

+ Roots *CertPool

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL