gocryptox509-go1.26.10

Unexpected verifications

These testcases were expected to fail, but succeeded instead.

Testcase	Context
pathological::nc-dos-1	validation: chain built
pathological::nc-dos-2	validation: chain built
rfc5280::aki::leaf-missing-aki	validation: chain built
rfc5280::aki::intermediate-missing-aki	validation: chain built
rfc5280::aki::cross-signed-root-missing-aki	validation: chain built
rfc5280::eku::ee-eku-empty	validation: chain built
rfc5280::nc::permitted-dns-match-noncritical	validation: chain built
rfc5280::nc::permitted-empty-sequence-excluded-nonempty	validation: chain built
rfc5280::nc::permitted-nonempty-excluded-empty-sequence	validation: chain built
rfc5280::nc::invalid-dnsname-leading-period	validation: chain built
rfc5280::nc::not-allowed-in-ee-noncritical	validation: chain built
rfc5280::nc::not-allowed-in-ee-critical	validation: chain built
rfc5280::nc::nc-permits-email-domain-rejects-subdomain	validation: chain built
rfc5280::nc::nc-permits-uri-host-rejects-subdomain	validation: chain built
rfc5280::pc::ica-noncritical-pc	validation: chain built
rfc5280::san::noncritical-with-empty-subject	validation: chain built
rfc5280::san::underscore-dns	validation: chain built
rfc5280::serial::too-long	validation: chain built
rfc5280::serial::zero	validation: chain built
rfc5280::serial::negative	validation: chain built
rfc5280::ski::root-missing-ski	validation: chain built
rfc5280::ski::intermediate-missing-ski	validation: chain built
rfc5280::ca-empty-subject	validation: chain built
rfc5280::root-non-critical-basic-constraints	validation: chain built
rfc5280::root-inconsistent-ca-extensions	validation: chain built
rfc5280::leaf-ku-keycertsign	validation: chain built
webpki::aki::root-with-aki-missing-keyidentifier	validation: chain built
webpki::aki::root-with-aki-authoritycertissuer	validation: chain built
webpki::aki::root-with-aki-authoritycertserialnumber	validation: chain built
webpki::aki::root-with-aki-all-fields	validation: chain built
webpki::aki::root-with-aki-ski-mismatch	validation: chain built
webpki::cn::ipv4-hex-mismatch	validation: chain built
webpki::cn::ipv4-leading-zeros-mismatch	validation: chain built
webpki::cn::ipv6-uppercase-mismatch	validation: chain built
webpki::cn::ipv6-uncompressed-mismatch	validation: chain built
webpki::cn::ipv6-non-rfc5952-mismatch	validation: chain built
webpki::cn::punycode-not-in-san	validation: chain built
webpki::cn::utf8-vs-punycode-mismatch	validation: chain built
webpki::cn::not-in-san	validation: chain built
webpki::cn::case-mismatch	validation: chain built
webpki::eku::ee-anyeku	validation: chain built
webpki::eku::ee-critical-eku	validation: chain built
webpki::eku::ee-without-eku	validation: chain built
webpki::eku::root-has-eku	validation: chain built
webpki::san::public-suffix-wildcard-san	validation: chain built
webpki::san::public-suffix-multi-label-wildcard-san	validation: chain built
webpki::san::public-suffix-private-namespace-wildcard-san	validation: chain built
webpki::san::san-critical-with-nonempty-subject	validation: chain built
webpki::forbidden-dsa-leaf	validation: chain built
webpki::forbidden-weak-rsa-key-in-root	validation: chain built
webpki::forbidden-weak-rsa-in-leaf	validation: chain built
webpki::forbidden-rsa-not-divisible-by-8-in-root	validation: chain built
webpki::forbidden-rsa-key-not-divisible-by-8-in-leaf	validation: chain built
webpki::ee-basicconstraints-ca	validation: chain built
webpki::ca-as-leaf	validation: chain built

Unexpected failures

These testcases were expected to succeed, but failed instead.

Testcase	Context
pathlen::self-issued-certs-pathlen	validation: x509: too many intermediates for path length constraint
rfc5280::nc::permitted-dn-match	validation: x509: unhandled critical extension
rfc5280::nc::permitted-self-issued	validation: x509: a root or intermediate certificate is not authorized to sign for this name: DNS name "not-example.com" is not permitted by any constraint
rfc5280::nc::nc-forbids-othername-noop	validation: x509: unhandled critical extension
rfc5280::validity::notafter-fractional	validation: x509: certificate has expired or is not yet valid: current time 2024-04-01T00:00:00Z is after 2024-04-01T00:00:00Z
rfc9881::ml-dsa-44	validation: x509: certificate signed by unknown authority
rfc9881::ml-dsa-65	validation: x509: certificate signed by unknown authority
rfc9881::ml-dsa-87	validation: x509: certificate signed by unknown authority

Skipped tests

These testcases were skipped due to a harness or implementation limitation.

Testcase	Context
crl::structure::crl-invalid-signature	CRLs not supported
crl::structure::crl-wrong-signing-key	CRLs not supported
crl::structure::crl-empty	CRLs not supported
crl::structure::crl-very-large	CRLs not supported
crl::structure::crl-duplicate-revoked-serial	CRLs not supported
crl::structure::crl-unknown-critical-extension	CRLs not supported
crl::structure::crl-unknown-noncritical-extension	CRLs not supported
crl::structure::entry-unknown-critical-extension	CRLs not supported
crl::structure::entry-unknown-noncritical-extension	CRLs not supported
crl::temporal::this-update-in-future	CRLs not supported
crl::temporal::next-update-in-past	CRLs not supported
crl::temporal::revocation-date-in-future	CRLs not supported
crl::temporal::revocation-date-before-not-before	CRLs not supported
crl::temporal::crl-validity-no-overlap	CRLs not supported
crl::revoked-certificate-with-crl	CRLs not supported
crl::crlnumber-missing	CRLs not supported
crl::certificate-not-on-crl	CRLs not supported
crl::certificate-serial-on-crl-different-issuer	CRLs not supported
crl::crlnumber-critical	CRLs not supported
crl::issuer-missing-crlsign	CRLs not supported
crl::issuer-no-keyusage-extension	CRLs not supported
crl::issuer-valid-crlsign-and-keycertsign	CRLs not supported
pathlen::max-chain-depth-0	max chain depth not supported
pathlen::max-chain-depth-0-exhausted	max chain depth not supported
pathlen::max-chain-depth-1	max chain depth not supported
pathlen::max-chain-depth-1-exhausted	max chain depth not supported
pathlen::max-chain-depth-1-self-issued	max chain depth not supported
pathological::intermediate-cycle-distinct-cas-max-depth	max chain depth not supported
rfc5280::nc::invalid-email-address	unimplemented validationKindClient
rfc5280::nc::nc-permits-invalid-email-san	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-exact	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-domain	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-asterisk-exact-match	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-asterisk-rejects-user	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-asterisk-rejects-subdomain	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-double-asterisk	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-double-asterisk-rejects-single	unimplemented validationKindClient
rfc5280::nc::nc-permits-email-literal-mid-asterisk	unimplemented validationKindClient