diff --git a/src/crypto/x509/x509.go b/src/crypto/x509/x509.go index bbc63241c6..126432d875 100644 --- a/src/crypto/x509/x509.go +++ b/src/crypto/x509/x509.go @@ -909,10 +909,6 @@ func parseCertificate(in *certificate) (*Certificate, error) { return nil, err } - if in.TBSCertificate.SerialNumber.Sign() < 0 { - return nil, errors.New("x509: negative serial number") - } - out.Version = in.TBSCertificate.Version + 1 out.SerialNumber = in.TBSCertificate.SerialNumber diff --git a/src/crypto/x509/x509_test.go b/src/crypto/x509/x509_test.go index 61b1773745..2c01ec7bf1 100644 --- a/src/crypto/x509/x509_test.go +++ b/src/crypto/x509/x509_test.go @@ -343,7 +343,11 @@ func TestCreateSelfSignedCertificate(t *testing.T) { for _, test := range tests { commonName := "test.example.com" template := Certificate{ - SerialNumber: big.NewInt(1), + // SerialNumber is negative to ensure that negative + // values are parsed. This is due to the prevalence of + // buggy code that produces certificates with negative + // serial numbers. + SerialNumber: big.NewInt(-1), Subject: pkix.Name{ CommonName: commonName, Organization: []string{"Σ Acme Co"},