cryptox509parse_certificate_request and subject alternate name (SAN)

[3goats]

Hi,

I'm using cryptox509parse_certificate_request to parse and attempt to validate an X.509 certificate request. I can see the output of the request, however its seems to be missing the Subject Alternative Name fields. Is there something I'm missing here ?

[3goats]

OK I think I see. The SAN is base64 encoded. So I decoded it.

output := crypto.x509.parse_certificate_request(input.csr)
y := base64.decode(output.Extensions[0].Value)

Seems to be a lot of noise before the real value (3goats@acme.com).

"y": "0!\ufffd\u001f\u0006\n+\u0006\u0001\u0004\u0001\ufffd7\u0014\u0002\u0003\ufffd\u0011\f\u000f3goats@acme.com"

Any idea what this is ?

[charlieegan3]

Hi Carl, how's it going? 🙂

Under the hood, this function is just running the Go function x509.ParseCertificateRequest (https://pkg.go.dev/crypto/x509#ParseCertificateRequest).

The data is base64 encoded, this is done in Go when a []byte is marshalled. However, as I understand it, the underlying data is a DER encoded, ASN.1 value. This is what you are seeing, and it's not something we have a built-in function in Rego to decode.

Please consider opening an issue with some more details about the use case and we might be able to work something out!