-
Notifications
You must be signed in to change notification settings - Fork 231
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Raw data in x509.Certificate does not equal RawLogEntry.Cert.Data for precertificates #950
Comments
Hi Ricky, I think the field in If so, as the comment on that field says, it's really just a convenience thing to have have easy access to the fields in the TBS from the precert. One thing to bear in mind is that the TBS cert will have been modified from the form it was in when it was read from the precert (see here for the processing that happens). At this point the original signature from the precert is not going to be valid for the marshalled TBS DER bytes, and unmarshalling the original precert DER bytes wouldn't recreate the TBS structure, so putting those precert DER bytes into the It could be argued that Hope that's helpful. Cheers, |
Hi there,
Yes
Okay, I understand that.
But currently Maybe I can try to explain my use case. Currently I'm doing something like this: var rawLogEntry *ct.RawLogEntry
// [...]
logEntry, _ := rawLogEntry.ToLogEntry()
var cert *x509.Certificate
var rawData []byte
switch {
case logEntry.X509Cert != nil:
cert = logEntry.X509Cert
rawData = logEntry.X509Cert.Raw
case logEntry.Precert != nil:
cert = logEntry.Precert.TBSCertificate
rawData = logEntry.Precert.Submitted.Data
default:
log.Println("Could not find certificate in entry")
}
calculatedHash := calculateSHA1(rawData) I want to extract the raw bytes and the parsed certificate information for both, regular certs and precerts. switch {
case logEntry.X509Cert != nil:
cert = logEntry.X509Cert
rawData = logEntry.X509Cert.Raw
case logEntry.Precert != nil:
cert = logEntry.Precert // or logEntry.Precert.TBSCertificate,
rawData = logEntry.Precert.Raw
default:
log.Println("Could not find certificate in entry")
} If everything works as intended, feel free to close this issue or keep it as a mere suggestion. It just feels weird so I wanted to ask if I was doing something wrong or if this is the way the code is supposed to work. Cheers, |
Hi there,
this is a follow-up to #947.
Description
I want to generate hashes of certificates. To do that I use the raw data (bytes) stored in
x509.Certificate.Raw
. Forx509.Certificate
generated fromPrecertificate
entries I am not getting the full (raw) certificate data in thex509.Certificate.Raw
field.Going one layer up, the
Precertificate
fieldSubmitted
contains the full submitted data which is also what I expected to be contained within thex509.Certificate.Raw
field. Instead theRaw
field seems to contain the unsigned certificate, which I don't fully understand. Eventually, for the TBS cert there is a whole other field (RawTBSCertificate
). Also the Signature field is empty for Precertificates.Looking at the Precertificate docs for the field
Submitted
:Regular entry:
The ct.RawLogEntry.Cert.Data does equal the
LogEntry
.Precertificate entry:
Question
Is it intended that Precertificates do not contain the full DER-encoded data including the generated signature in the Raw field, but instead we must fall back to the
Precertificate.Submitted
field? I thought it would be more consistent and easier to have the raw certificate data in one place and not multiple ones.The text was updated successfully, but these errors were encountered: