{"action":"created","issue":{"url":"https://api.github.com/repos/bcgit/bc-csharp/issues/158","repository_url":"https://api.github.com/repos/bcgit/bc-csharp","labels_url":"https://api.github.com/repos/bcgit/bc-csharp/issues/158/labels{/name}","comments_url":"https://api.github.com/repos/bcgit/bc-csharp/issues/158/comments","events_url":"https://api.github.com/repos/bcgit/bc-csharp/issues/158/events","html_url":"https://github.com/bcgit/bc-csharp/issues/158","id":372903793,"node_id":"MDU6SXNzdWUzNzI5MDM3OTM=","number":158,"title":"x509 certificates that could be read in 1.8.1 can no longer be read by 1.8.3","user":{"login":"jburger","id":579657,"node_id":"MDQ6VXNlcjU3OTY1Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/579657?v=4","gravatar_id":"","url":"https://api.github.com/users/jburger","html_url":"https://github.com/jburger","followers_url":"https://api.github.com/users/jburger/followers","following_url":"https://api.github.com/users/jburger/following{/other_user}","gists_url":"https://api.github.com/users/jburger/gists{/gist_id}","starred_url":"https://api.github.com/users/jburger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jburger/subscriptions","organizations_url":"https://api.github.com/users/jburger/orgs","repos_url":"https://api.github.com/users/jburger/repos","events_url":"https://api.github.com/users/jburger/events{/privacy}","received_events_url":"https://api.github.com/users/jburger/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"peterdettman","id":3423981,"node_id":"MDQ6VXNlcjM0MjM5ODE=","avatar_url":"https://avatars3.githubusercontent.com/u/3423981?v=4","gravatar_id":"","url":"https://api.github.com/users/peterdettman","html_url":"https://github.com/peterdettman","followers_url":"https://api.github.com/users/peterdettman/followers","following_url":"https://api.github.com/users/peterdettman/following{/other_user}","gists_url":"https://api.github.com/users/peterdettman/gists{/gist_id}","starred_url":"https://api.github.com/users/peterdettman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peterdettman/subscriptions","organizations_url":"https://api.github.com/users/peterdettman/orgs","repos_url":"https://api.github.com/users/peterdettman/repos","events_url":"https://api.github.com/users/peterdettman/events{/privacy}","received_events_url":"https://api.github.com/users/peterdettman/received_events","type":"User","site_admin":false},"assignees":[{"login":"peterdettman","id":3423981,"node_id":"MDQ6VXNlcjM0MjM5ODE=","avatar_url":"https://avatars3.githubusercontent.com/u/3423981?v=4","gravatar_id":"","url":"https://api.github.com/users/peterdettman","html_url":"https://github.com/peterdettman","followers_url":"https://api.github.com/users/peterdettman/followers","following_url":"https://api.github.com/users/peterdettman/following{/other_user}","gists_url":"https://api.github.com/users/peterdettman/gists{/gist_id}","starred_url":"https://api.github.com/users/peterdettman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/peterdettman/subscriptions","organizations_url":"https://api.github.com/users/peterdettman/orgs","repos_url":"https://api.github.com/users/peterdettman/repos","events_url":"https://api.github.com/users/peterdettman/events{/privacy}","received_events_url":"https://api.github.com/users/peterdettman/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2018-10-23T09:37:14Z","updated_at":"2018-10-24T04:59:14Z","closed_at":null,"author_association":"NONE","body":"I'm having some difficulty with certain x.509 certificates, when reading with version `1.8.3` - manifesting in an Exception that was introduced as part of an 'extra data' check. \r\n\r\nI believe the change the effects us is https://github.com/bcgit/bc-csharp/commit/374564ba8b2b385c90633679aae9cca27d0bb069 \r\n\r\nIt appears to be related to a version number and a subsequent check for 'extra data' - which fails. \r\n\r\nHere is a typical stack trace of `1.8.3` during certificate read:\r\n\r\n```\r\nOrg.BouncyCastle.Security.Certificates.CertificateException: Failed to read certificate ---> System.ArgumentException: version 1 certificate contains extra data\r\nat Org.BouncyCastle.Asn1.X509.TbsCertificateStructure..ctor(Asn1Sequence seq)\r\nat Org.BouncyCastle.Asn1.X509.TbsCertificateStructure.GetInstance(Object obj)\r\nat Org.BouncyCastle.Asn1.X509.X509CertificateStructure..ctor(Asn1Sequence seq)\r\nat Org.BouncyCastle.Asn1.X509.X509CertificateStructure.GetInstance(Object obj)\r\nat Org.BouncyCastle.X509.X509CertificateParser.ReadDerCertificate(Asn1InputStream dIn)\r\nat Org.BouncyCastle.X509.X509CertificateParser.ReadCertificate(Stream inStream)\r\n--- End of inner exception stack trace ---\r\nat Org.BouncyCastle.X509.X509CertificateParser.ReadCertificate(Stream inStream)\r\nat Org.BouncyCastle.OpenSsl.PemReader.ReadCertificate(PemObject pemObject)\r\n```\r\n\r\nHere is an example of a certificate that causes the exception:\r\n```\r\n-----BEGIN CERTIFICATE-----\r\nMIIDAjCCAeoCFB+M5Oi9qfGrPikV/d44DfLCVMDuMA0GCSqGSIb3DQEBCwUAMC4x\r\nCzAJBgNVBAYTAlVTMQwwCgYDVQQKDANYWFgxETAPBgNVBAMMCE15IENBIFYzMB4X\r\nDTE4MTAyMzA4MjQzOFoXDTI4MTAyMDA4MjQzOFowLjELMAkGA1UEBhMCVVMxDDAK\r\nBgNVBAoMA1hYWDERMA8GA1UEAwwITXkgQ0EgVjMwggEiMA0GCSqGSIb3DQEBAQUA\r\nA4IBDwAwggEKAoIBAQC2ATfFRW9oM3Yz10EEIVcRlOnfPsQQBT9Z7GKuP5MKZAI1\r\nCHX9ujf1A/EeKBHtCTU5q7TLtRIpAfFVJj7KynSqcN9SzXBvvyIX82VienV4S4XK\r\nywiY0yfmeVFZy2IQz2o5vm+Al+jzBm200rwPtadHy0z4xsLy7ly1K1fd828Ui9pB\r\nnCaeuoih4n2GSpqgNIHnlkHGwmWYeryveXpSsWJYodQroNl89usHqRXlH0alVpQs\r\nTfk+LNoiDGwTdRZFeLYo/Rqw0iSvCNgSULrK2TpT4ZNHe6HIr9I2t9fNUvf0J9bG\r\nEJrL1K7Gh2V85dcYBs/0Nh+eFs7Hp5Ua0JlxCufjAgMBAAGjHTAbMAwGA1UdEwQF\r\nMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQASQ6195ALx1Mfs\r\nZXF5OqBKC6DR0d4UC/pxth5xpl5wM5FpiH/bMUIqzKLEvyV3ZMZ4UyPC+tn5k+gs\r\nHAwUJpZDKKmzhgZbmeuwNbRk3H5NRjQ3do2jwneDdIGAI8DtjOlEOtbkfO0xDxP/\r\nUM7EUt3/Lk6SxPhoDep7MdkWzJkpjzPzz3UO/nGNTfGOJza2pTIV+h7oKGpnxkdX\r\n4oJOLBa1C4ONDQQOCYpC2O+66p/j5YGIY/ifuxviPItYk8DZR2YgNC7vRuVMBXAz\r\nwY48OlOW+ybmolmMO4Hg19BT45zJLEqF/Sju+e+QZHMHTe5jen76cA3RZxdQ656w\r\nwj47Z+DO\r\n-----END CERTIFICATE-----\r\n```\r\n\r\nI can share some code that was used to generate this certificate if that aids tracking down the issue.\r\n\r\nThis certificate can be read in 1.8.1:\r\n![image](https://user-images.githubusercontent.com/579657/47350996-9edb2780-d6fe-11e8-8dbc-13e40eada692.png)\r\n\r\nThe windows certificate store and openssl seem to be OK with this certificate, so I'm hoping that I could get some advice on whether there is something wrong with this certificate, or if there is an issue in these new checks that needs further thought?\r\n\r\nThanks!\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/bcgit/bc-csharp/issues/comments/432513242","html_url":"https://github.com/bcgit/bc-csharp/issues/158#issuecomment-432513242","issue_url":"https://api.github.com/repos/bcgit/bc-csharp/issues/158","id":432513242,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMjUxMzI0Mg==","user":{"login":"LarryRothOakton","id":5995974,"node_id":"MDQ6VXNlcjU5OTU5NzQ=","avatar_url":"https://avatars3.githubusercontent.com/u/5995974?v=4","gravatar_id":"","url":"https://api.github.com/users/LarryRothOakton","html_url":"https://github.com/LarryRothOakton","followers_url":"https://api.github.com/users/LarryRothOakton/followers","following_url":"https://api.github.com/users/LarryRothOakton/following{/other_user}","gists_url":"https://api.github.com/users/LarryRothOakton/gists{/gist_id}","starred_url":"https://api.github.com/users/LarryRothOakton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/LarryRothOakton/subscriptions","organizations_url":"https://api.github.com/users/LarryRothOakton/orgs","repos_url":"https://api.github.com/users/LarryRothOakton/repos","events_url":"https://api.github.com/users/LarryRothOakton/events{/privacy}","received_events_url":"https://api.github.com/users/LarryRothOakton/received_events","type":"User","site_admin":false},"created_at":"2018-10-24T04:59:14Z","updated_at":"2018-10-24T04:59:14Z","author_association":"NONE","body":"Hi @peterdettman I'm a software developer for a consulting company. We are currently building a medical system for the Red Cross Blood Service in Australia that manages organ transplants. We rely on on software that @jburger produces to deploy our application. When our application goes into production next year, it could result in life or death if it does not function correctly or we are blocked from deploying critical fixes.\r\n\r\nFor this issue, I consider it irresponsible to deploy a breaking change for a minor release from 1.8.1 to 1.8.3 that could have potential downstream effects. We're lucky in this instance that the affected certificate (which does have a configuration error) is currently not in use and that our system is not in production yet.\r\n\r\nIf a breaking change like this is implemented, there should be the option to revert to the old behaviour with some flags in the method calls in order to support existing artefacts. Environment such as ours could require advanced warning and time to sort this out and regenerate certificates.\r\n\r\nOur client is very sensitive to any defects, especially those that could bring our software \"assembly line\" to a halt.\r\n\r\nHoping this can be addressed soon!\r\n\r\nThanks!\r\n"}}
{"actor":{"display_login":"LarryRothOakton"}}