google / google/certificate-transparency-go
Raw data in x509.Certificate does not equal RawLogEntry.Cert.Data for precertificates
- Dominant language
- Go
- Stars
- 1.2k
- Forks
- 322
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 5
Description
Hi there,
this is a follow-up to #947.
## Description
I want to generate hashes of certificates. To do that I use the raw data (bytes) stored in `x509.Certificate.Raw`. For [`x509.Certificate`](https://pkg.go.dev/github.com/google/certificate-transparency-go/x509#Certificate) generated from [`Precertificate`](https://pkg.go.dev/github.com/google/certificate-transparency-go#Precertificate) entries I am not getting the full (raw) certificate data in the `x509.Certificate.Raw` field.
Going one layer up, the `Precertificate` field `Submitted` contains the full submitted data which is also what I expected to be contained within the `x509.Certificate.Raw` field. Instead the `Raw` field seems to contain the unsigned certificate, which I don't fully understand. Eventually, for the TBS cert there is a whole other field (`RawTBSCertificate`). Also the Signature field is empty for Precertificates.
Looking at the Precertificate docs for the field `Submitted`:
>// DER-encoded pre-certificate as originally added, which includes [...] a signature generated over the pre-cert by the pre-cert issuer (which might differ from the issuer of the final cert, see RFC6962 s3.1).
#### Regular entry:

The ct.RawLogEntry.Cert.Data does equal the [`LogEntry`](https://pkg.go.dev/github.com/google/certificate-transparency-go#LogEntry).
#### Precertificate entry:

## Question
Is it intended that Precertificates do not contain the full DER-encoded data including the generated signature in the Raw field, but instead we must fall back to the `Precertificate.Submitted` field? I thought it would be more consistent and easier to have the raw certificate data in one place and not multiple ones.
Contributor guide
Assessment
This issue has not been assessed yet.