crypto/x509: add ExtKeyUsage.OID

// This program demonstrates how to detect an unknown Extended Key Usage (EKU)
// in a certificate using Go 1.27.1, where the standard library does not
// provide ExtKeyUsage.OID(). It parses the EKU extension directly from the
// ASN.1 data to obtain the OID. The output shows the OID that was not
// recognized by the x509 package.

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"crypto/x509/pkix"
	"encoding/asn1"
	"encoding/pem"
	"fmt"
	"math/big"
	"time"
)

func main() {
	// Create a self‑signed certificate that contains an EKU with an OID
	// that the standard library does not recognize (1.2.3.4.5.6).
	unknownEKU := asn1.ObjectIdentifier{1, 2, 3, 4, 5, 6}

	// Build the EKU extension manually.
	ekuExt, err := asn1.Marshal([]asn1.ObjectIdentifier{unknownEKU})
	if err != nil {
		panic(err)
	}
	ext := pkix.Extension{
		Id:    asn1.ObjectIdentifier{2, 5, 29, 37}, // id-ce-extKeyUsage
		Value: ekuExt,
	}

	// Generate a key for the certificate.
	priv, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		panic(err)
	}

	// Create the certificate template.
	template := x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject: pkix.Name{
			CommonName: "example.com",
		},
		NotBefore:             time.Now(),
		NotAfter:              time.Now().Add(365 * 24 * time.Hour),
		KeyUsage:              x509.KeyUsageDigitalSignature,
		BasicConstraintsValid: true,
		IsCA:                  true,
		// Include the manually built EKU extension.
		ExtraExtensions: []pkix.Extension{ext},
	}

	// Create the DER‑encoded certificate.
	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
	if err != nil {
		panic(err)
	}

	// Encode the certificate as PEM for display.
	pemBlock := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
	fmt.Println(string(pemBlock))

	// Parse the certificate with the standard library.
	cert, err := x509.ParseCertificate(derBytes)
	if err != nil {
		panic(err)
	}

	// The unknown EKU will appear in UnknownExtKeyUsage.
	fmt.Println("UnknownExtKeyUsage:", cert.UnknownExtKeyUsage)

	// To check the EKU OID, we must parse the extension ourselves.
	// Find the EKU extension by OID.
	var ekuValue []byte
	for _, e := range cert.Extensions {
		if e.Id.Equal(asn1.ObjectIdentifier{2, 5, 29, 37}) {
			ekuValue = e.Value
			break
		}
	}
	if ekuValue == nil {
		fmt.Println("EKU extension not found")
		return
	}

	// Decode the EKU extension value.
	var oids []asn1.ObjectIdentifier
	if _, err := asn1.Unmarshal(ekuValue, &oids); err != nil {
		fmt.Println("Failed to parse EKU extension:", err)
		return
	}
	fmt.Println("Parsed EKU OIDs:", oids)
}