crypto/x509: generate serial number for nil template SerialNumber

[rolandshoemaker]

Serial number generation is painfully complicated, especially if you want spec compliance. We've seen, over and over, that people get this wrong, even when trying to get it right.

We should provide an extremely simple way for people to get a correct serial easily. I propose that if the template passed to CreateCertificate contains a nil SerialNumber (currently an error), we will generate a conformant serial number, and add the following to the CreateCertificate documentation:

// If template.SerialNumber is nil, a serial number will be generated which
// conforms to RFC 5280, Section 4.1.2.2 using entropy from rand.

This is similar to, but somewhat different from, #52444. Either both, or just this proposal, could be implemented (the same logic would be used in both places).

[AGWA]

I like this more than #52444 since it requires less code to use, and doesn't require handling an additional error return. I can't think of a reason to ever generate a standalone serial number.

[rsc]

This proposal has been added to the active column of the proposals project
and will now be reviewed at the weekly proposal review meetings.
— rsc for the proposal review group

[rsc]

Have all remaining concerns about this proposal been addressed?

The proposal is to change CreateCertificate to handle a nil template.SerialNumber by generating a serial number according to RFC 5280, Section 4.1.2.2.

The other create routines do not take templates with serial numbers and are unaffected.

[rsc]

Based on the discussion above, this proposal seems like a likely accept.
— rsc for the proposal review group

The proposal is to change CreateCertificate to handle a nil template.SerialNumber by generating a serial number according to RFC 5280, Section 4.1.2.2.

The other create routines do not take templates with serial numbers and are unaffected.

[rsc]

No change in consensus, so accepted. 🎉
This issue now tracks the work of implementing the proposal.
— rsc for the proposal review group

The proposal is to change CreateCertificate to handle a nil template.SerialNumber by generating a serial number according to RFC 5280, Section 4.1.2.2.

The other create routines do not take templates with serial numbers and are unaffected.

[gopherbot]

Change https://go.dev/cl/630995 mentions this issue: crypto/x509: generate serial number for nil template SerialNumber

[dmitshur]

@rolandshoemaker There's no API change here, but this still seems like a change that should be covered in Go 1.24 release notes, is that right? Mentioning it there will also help more people discover this new to Go 1.24 ability to take advantage of it.

I'll reopen as a release blocker so this is easy to track; please update as needed. Thanks.

[gopherbot]

Change https://go.dev/cl/631683 mentions this issue: doc: add note about crypto/x509 serial generation