Detect root x509 certificate in Go

Adam Williams:

I have X509 certificate obtained using:

block, additionalData := pem.Decode([]byte(str))
cert, err := x509.ParseCertificate(block.Bytes)

I want to check if the certificate is a root certificate. I've tried checking IsCA, but the same is true for intermediate certificates. I also tried something like this:

if cert.KeyUsage & x509.KeyUsageCertSign { //.....

But this is also true for intermediates, as they are allowed to sign leaf certificates.

Should I do something else? Maybe compare byte by byte RawSubjectand RawIssuerexpect the same thing (false for self-signed leaves certainly not)?

Adam Williams:

Check that IsCAflags and theme == issuer are working.

block, _ := pem.Decode([]byte("-----BEGIN CERTIFICATE-----\nMIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4\nWhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu\nZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY\nMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc\nh77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+\n0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U\nA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW\nT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH\nB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC\nB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv\nKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn\nOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn\njh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw\nqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI\nrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV\nHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq\nhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL\nubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ\n3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK\nNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5\nORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur\nTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC\njNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc\noyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq\n4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA\nmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d\nemyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=\n-----END CERTIFICATE-----"))
cert, _ := x509.ParseCertificate(block.Bytes)

if bytes.Equal(cert.RawIssuer, cert.RawSubject) && cert.IsCA {
    println("It's a CA")
}

Related

Detect root x509 certificate in Go

Adam Williams: I have X509 certificate obtained using: block, additionalData := pem.Decode([]byte(str)) cert, err := x509.ParseCertificate(block.Bytes) I want to check if the certificate is a root certificate. I've tried checking IsCA, but the same is true fo

Detect root x509 certificate in Go

Adam Williams: I have X509 certificate obtained using: block, additionalData := pem.Decode([]byte(str)) cert, err := x509.ParseCertificate(block.Bytes) I want to check if the certificate is a root certificate. I've tried checking IsCA, but the same is true fo

Detect root x509 certificate in Go

Adam Williams: I have X509 certificate obtained using: block, additionalData := pem.Decode([]byte(str)) cert, err := x509.ParseCertificate(block.Bytes) I want to check if the certificate is a root certificate. I've tried checking IsCA, but the same is true fo

x509 certificate signed by unknown authority - Go-pingdom

Maz: I am using the Go package to pingdom-goquery Pingdom. The application is containerized by: FROM alpine:3.8 USER nobody ADD build/_output/bin/app /usr/local/bin/app But I get the following error: Get https://api.pingdom.com/api/2.1/checks/0: x509: certi

How to get x509 certificate from http client in Go

mjb2kmn： I've gone through the documentation at https://golang.org/pkg/ but I can't make this connection. I am creating a client and requesting like this (error handling removed): client := http.Client{ CheckRedirect: func(req *http.Request, via []*http.Re

IsCA certificate setup in Go x509 package

ClubPetey： When creating an intermediate root certificate, do you set the "IsCA" property of the certificate template? What is the purpose of this property? I am creating a certificate chain for an application. In this application, I need to use an intermediat

How to get x509 certificate from http client in Go

mjb2kmn： I've gone through the documentation at https://golang.org/pkg/ but I can't make this connection. I am creating a client and requesting like this (error handling removed): client := http.Client{ CheckRedirect: func(req *http.Request, via []*http.Re

x509 certificate signed by unknown authority - Go-pingdom

Maz: I am using the Go package to pingdom-goquery Pingdom. The application is containerized by: FROM alpine:3.8 USER nobody ADD build/_output/bin/app /usr/local/bin/app But I get the following error: Get https://api.pingdom.com/api/2.1/checks/0: x509: certi

IsCA certificate setup in Go x509 package

ClubPetey： When creating an intermediate root certificate, do you set the "IsCA" property of the certificate template? What is the purpose of this property? I am creating a certificate chain for an application. In this application, I need to use an intermediat

How to get x509 certificate from http client in Go

mjb2kmn： I've gone through the documentation at https://golang.org/pkg/ but I can't make this connection. I am creating a client and requesting like this (error handling removed): client := http.Client{ CheckRedirect: func(req *http.Request, via []*http.Re

IsCA certificate setup in Go x509 package

ClubPetey： When creating an intermediate root certificate, do you set the "IsCA" property of the certificate template? What is the purpose of this property? I am creating a certificate chain for an application. In this application, I need to use an intermediat

x509 certificate signed by unknown authority - Go-pingdom

Maz: I am using the Go package to pingdom-goquery Pingdom. The application is containerized by: FROM alpine:3.8 USER nobody ADD build/_output/bin/app /usr/local/bin/app But I get the following error: Get https://api.pingdom.com/api/2.1/checks/0: x509: certi

Certificate chain X509

Omar Amalfi Hi I want to generate certificate chain using c#. Something like this: I created this code for generation: using System; using System.Security.Cryptography; using System.Security.Cryptography.X509Certificates; namespace CC.CertificateCore { pu