Documentation
¶
Overview ¶
Package x509decode parses X.509 certificates into a structured view — the natural complement to tls_handshake_decode (whose Certificate handshake-message body is surfaced as raw hex). Operators paste a PEM or DER blob and inspect subject, issuer, validity, SANs, key usage, EKU, AIA, CRL distribution points, and fingerprints without dragging out `openssl x509 -text` or pulling the cert into a separate inspection tool.
Wrap-vs-native judgement ¶
Native — via the Go standard library's crypto/x509 + encoding/pem packages. The X.509 v3 format is defined by RFC 5280 + supporting RFCs (CT, SCTs, ACME, etc.); stdlib handles the recursive ASN.1 DER walk so this package can focus on rendering the parsed fields into the same JSON shape every other native-fit decoder in this codebase uses. No vendor SDK, no networking, no cryptographic operations beyond computing the SHA-1 + SHA-256 fingerprints — well within the stdlib scope.
What this package covers ¶
- PEM and DER input auto-detection: input starting with "-----BEGIN CERTIFICATE-----" is decoded as PEM (with base64 unwrap and chain support — the first cert in the chain is decoded; subsequent certs are exposed via a count); everything else is treated as hex-encoded DER.
- Subject + Issuer Distinguished Name: each RDN (CommonName, Organization, OrganizationalUnit, Country, Province, Locality, StreetAddress, PostalCode, SerialNumber) is surfaced as both a flat string and the full DN as a canonical openssl-style string.
- Serial number rendered as both decimal and uppercase hex (the form printed by every certificate UI).
- Validity window: NotBefore + NotAfter as RFC 3339 timestamps + a `days_remaining` count for quick expiration triage (negative when already expired).
- Public key algorithm + key size:
- RSA: modulus size in bits (1024 / 2048 / 4096 / etc.).
- ECDSA: curve name (P-256 / P-384 / P-521).
- Ed25519 / Ed448: marked by name.
- DSA: modulus size.
- Signature algorithm name (SHA1-RSA / SHA256-RSA / SHA- 256-ECDSA / SHA256-RSA-PSS / Ed25519 / etc.).
- X.509 version (v1 / v2 / v3).
- Extensions:
- Subject Alternative Names (DNS / IP / email / URI).
- Key Usage (digital signature / key encipherment / cert signing / etc.).
- Extended Key Usage (server auth / client auth / code signing / email protection / OCSP signing / time stamping / etc.).
- Basic Constraints (CA flag + optional path length).
- Authority Information Access (OCSP responder URLs + CA Issuer URLs).
- CRL Distribution Points (URLs).
- Subject Key Identifier (SKI, hex-encoded).
- Authority Key Identifier (AKI, hex-encoded).
- Certificate Policies (OIDs).
- Fingerprints: SHA-1 (legacy / GUI-displayed), SHA-256 (modern / SPKI pinning).
What this package does NOT cover (deliberately out of scope) ¶
- Chain validation (signature verification, trust-store traversal, revocation checks) — pure decoding only. The caller can wire a follow-up Spec that walks a decoded chain against a configured trust store.
- Certificate Transparency SCT decoding (SCT list extension is recognised by OID but the body is surfaced as raw hex; SCT v1 binary format is a separate ~200 LoC walker).
- CSR (Certificate Signing Request) parsing — that's a different ASN.1 structure; a future Spec can cover it.
- CRL (Certificate Revocation List) parsing — separate iteration, different ASN.1 structure.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Certificate ¶
type Certificate struct {
Source string `json:"source"`
Version int `json:"version"`
SerialNumberHex string `json:"serial_number_hex"`
SerialNumberDec string `json:"serial_number_decimal"`
SubjectDN string `json:"subject_dn"`
Subject *Name `json:"subject"`
IssuerDN string `json:"issuer_dn"`
Issuer *Name `json:"issuer"`
NotBefore string `json:"not_before"`
NotAfter string `json:"not_after"`
DaysRemaining int `json:"days_remaining"`
Expired bool `json:"expired"`
PublicKeyAlgorithm string `json:"public_key_algorithm"`
PublicKeyDetails string `json:"public_key_details"`
SignatureAlgorithm string `json:"signature_algorithm"`
Extensions *Extensions `json:"extensions,omitempty"`
FingerprintSHA1 string `json:"fingerprint_sha1"`
FingerprintSHA256 string `json:"fingerprint_sha256"`
SelfSigned bool `json:"self_signed"`
IsCA bool `json:"is_ca"`
ChainLength int `json:"chain_length_seen,omitempty"`
}
Certificate is the decoded view of one X.509 v3 certificate.
func Decode ¶
func Decode(input string) (*Certificate, error)
Decode parses a PEM or hex-DER certificate input.
PEM input is detected by the "-----BEGIN" prefix. For PEM chains the first certificate is decoded and the total chain length is reported via ChainLength.
type Extensions ¶
type Extensions struct {
DNSNames []string `json:"dns_names,omitempty"`
IPAddresses []string `json:"ip_addresses,omitempty"`
EmailAddresses []string `json:"email_addresses,omitempty"`
URIs []string `json:"uris,omitempty"`
KeyUsage []string `json:"key_usage,omitempty"`
ExtendedKeyUsage []string `json:"extended_key_usage,omitempty"`
BasicConstraintsValid bool `json:"basic_constraints_valid"`
IsCA bool `json:"is_ca,omitempty"`
MaxPathLen int `json:"max_path_len,omitempty"`
MaxPathLenZero bool `json:"max_path_len_zero,omitempty"`
OCSPServers []string `json:"ocsp_servers,omitempty"`
IssuingCertificateURLs []string `json:"issuing_certificate_urls,omitempty"`
CRLDistributionPoints []string `json:"crl_distribution_points,omitempty"`
SubjectKeyID string `json:"subject_key_id_hex,omitempty"`
AuthorityKeyID string `json:"authority_key_id_hex,omitempty"`
PolicyOIDs []string `json:"policy_oids,omitempty"`
}
Extensions carries the operationally-interesting v3 extensions.
type Name ¶
type Name struct {
CommonName string `json:"common_name,omitempty"`
Country []string `json:"country,omitempty"`
Organization []string `json:"organization,omitempty"`
OrganizationalUnit []string `json:"organizational_unit,omitempty"`
Locality []string `json:"locality,omitempty"`
Province []string `json:"province,omitempty"`
StreetAddress []string `json:"street_address,omitempty"`
PostalCode []string `json:"postal_code,omitempty"`
SerialNumber string `json:"serial_number,omitempty"`
}
Name is the structured view of a DN.
Source Files