This commit adds an explicit `golangci-lint` configuration that
simply matches the default linters previously in use, and then
fixes all current linter findings.
Aside from tweaking error message strings, this commit introduces
one externally visible behavior change: PEM data generated from
PKCS#12 files now correctly identifies private key blocks as
`RSA PRIVATE KEY` or `EC PRIVATE KEY`, whereas previously it
generated invalid `PRIVATE KEY` blocks with non-PKCS#8 data.
This commit lays the groundwork for more aggressive linting in the
future, and identifies some additional issues via TODOs.
Fixes#272. The root of the problem is that we're asking the wrong OCSP servers. The current code does something like:
leaf, issuers := chain[0], chain[1:]
for _, issuer := range issuers {
// check for revocation of leaf via issuer.OCSPServer
}
The main problem is that OCSPServer is the URI of the OCSP server for that certificate, and by asking issuer.OCSPServer about leaf, we're requesting OCSP responses from the wrong server. We should be checking leaf.OCSPServer in this example instead of issuer.OCSPServer.
The second problem is that the loop makes no sense. One would not expect any OCSP server in a given chain to be authoritative for a given leaf.
If you do certigo connect google.com, you'll see
Certificate has OCSP extension, but was unable to check status:
ocsp: error from server: unauthorized
The "unauthorized" means the OCSP server we asked doesn't know anything about the cert we asked about.
Nik Unger