x509-cert: parse failure on publicly known certificate

[woodruffw]

Ran into this in my continued adventures with Windows cert store parsing: the cert identified as 28903a635b5280fae6774c0b6da7d6baa64af2e8 fails with:

malformed ASN.1 DER value for INTEGER at DER byte 50

Here's the cert, in PEM form:

-----BEGIN CERTIFICATE-----
MIIFVjCCBD6gAwIBAgIQ7is969Qh3hSoYqwE893EATANBgkqhkiG9w0BAQUFADCB
8zELMAkGA1UEBhMCRVMxOzA5BgNVBAoTMkFnZW5jaWEgQ2F0YWxhbmEgZGUgQ2Vy
dGlmaWNhY2lvIChOSUYgUS0wODAxMTc2LUkpMSgwJgYDVQQLEx9TZXJ2ZWlzIFB1
YmxpY3MgZGUgQ2VydGlmaWNhY2lvMTUwMwYDVQQLEyxWZWdldSBodHRwczovL3d3
dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbCAoYykwMzE1MDMGA1UECxMsSmVyYXJxdWlh
IEVudGl0YXRzIGRlIENlcnRpZmljYWNpbyBDYXRhbGFuZXMxDzANBgNVBAMTBkVD
LUFDQzAeFw0wMzAxMDcyMzAwMDBaFw0zMTAxMDcyMjU5NTlaMIHzMQswCQYDVQQG
EwJFUzE7MDkGA1UEChMyQWdlbmNpYSBDYXRhbGFuYSBkZSBDZXJ0aWZpY2FjaW8g
KE5JRiBRLTA4MDExNzYtSSkxKDAmBgNVBAsTH1NlcnZlaXMgUHVibGljcyBkZSBD
ZXJ0aWZpY2FjaW8xNTAzBgNVBAsTLFZlZ2V1IGh0dHBzOi8vd3d3LmNhdGNlcnQu
bmV0L3ZlcmFycmVsIChjKTAzMTUwMwYDVQQLEyxKZXJhcnF1aWEgRW50aXRhdHMg
ZGUgQ2VydGlmaWNhY2lvIENhdGFsYW5lczEPMA0GA1UEAxMGRUMtQUNDMIIBIjAN
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsyLHT+KXQpWIR4NA9h0X84NzJB5R
85iKw5K4/0CQBXCHYMkAqbWUZRkiFRfCQ2xmRJoNBD45b6VLeqpjt4pEndljkYRm
4CgPukLjbo73FCeTae6RDqNfDrHrZqJyTxIThmV6PttPB/SnCWDaOkKZx7J/sxaV
HMf5NLWUhdWZXqBIoH7nF2W4onW4HvPlQn2v7fOKSGRdghST2MDk/7NQcvJ29rNd
QlB50JQ+awwAvthrDk4q7D7SzIKiGGUzE3eeml0aE9jD2z3Il3rucO2n5nzbcc8t
lGLfbdb1OL4/pYUKGbio2Al1QnDE6u/LDsg0qBIimAy4E5S2S+zw0JDnJwIDAQAB
o4HjMIHgMB0GA1UdEQQWMBSBEmVjX2FjY0BjYXRjZXJ0Lm5ldDAPBgNVHRMBAf8E
BTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUoMOLRKo3pUW/l4Ba0fF4
opvpXY0wfwYDVR0gBHgwdjB0BgsrBgEEAfV4AQMBCjBlMCwGCCsGAQUFBwIBFiBo
dHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbDA1BggrBgEFBQcCAjApGidW
ZWdldSBodHRwczovL3d3dy5jYXRjZXJ0Lm5ldC92ZXJhcnJlbCAwDQYJKoZIhvcN
AQEFBQADggEBAKBIW4IB9k1IuDlVNZyAelOZ1Vr/sXE7zDkJlF7W2u++AVtd0x7Y
/X1PzaBB4DSTv8vihpw3kpBWHNzrKQXlxJ7HNd+KDM3FIUPpqojlNcAZQmNaAl6k
SBg6hW/cnbw/nZzBh7h6YQjpdwt/cKt63dmXLGQehb+8dJahw3oS7AwaboMMPOhy
Rp/7SNVel+axofjk70YllJyJ22k4vuxcDlbHZVHlUIiIv0LVKz3l+bqeLrPK9HOS
Agu+TGbrIP65y7WZf+a2E/rKS03Z7lNGBjvGTq2TWoF+bCpLagVFjPIhpDGQh2xl
nJ2lYJU6Un/10asIbvPuW/mIPX64b24D5EI=
-----END CERTIFICATE-----

I can debug this on my own; just filing for visibility.

[woodruffw]

Here's how OpenSSL parses it:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
             (Negative)11:d4:c2:14:2b:de:21:eb:57:9d:53:fb:0c:22:3b:ff
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C = ES, O = Agencia Catalana de Certificacio (NIF Q-0801176-I), OU = Serveis Publics de Certificacio, OU = Vegeu https://www.catcert.net/verarrel (c)03, OU = Jerarquia Entitats de Certificacio Catalanes, CN = EC-ACC
        Validity
            Not Before: Jan  7 23:00:00 2003 GMT
            Not After : Jan  7 22:59:59 2031 GMT
        Subject: C = ES, O = Agencia Catalana de Certificacio (NIF Q-0801176-I), OU = Serveis Publics de Certificacio, OU = Vegeu https://www.catcert.net/verarrel (c)03, OU = Jerarquia Entitats de Certificacio Catalanes, CN = EC-ACC
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b3:22:c7:4f:e2:97:42:95:88:47:83:40:f6:1d:
                    17:f3:83:73:24:1e:51:f3:98:8a:c3:92:b8:ff:40:
                    90:05:70:87:60:c9:00:a9:b5:94:65:19:22:15:17:
                    c2:43:6c:66:44:9a:0d:04:3e:39:6f:a5:4b:7a:aa:
                    63:b7:8a:44:9d:d9:63:91:84:66:e0:28:0f:ba:42:
                    e3:6e:8e:f7:14:27:93:69:ee:91:0e:a3:5f:0e:b1:
                    eb:66:a2:72:4f:12:13:86:65:7a:3e:db:4f:07:f4:
                    a7:09:60:da:3a:42:99:c7:b2:7f:b3:16:95:1c:c7:
                    f9:34:b5:94:85:d5:99:5e:a0:48:a0:7e:e7:17:65:
                    b8:a2:75:b8:1e:f3:e5:42:7d:af:ed:f3:8a:48:64:
                    5d:82:14:93:d8:c0:e4:ff:b3:50:72:f2:76:f6:b3:
                    5d:42:50:79:d0:94:3e:6b:0c:00:be:d8:6b:0e:4e:
                    2a:ec:3e:d2:cc:82:a2:18:65:33:13:77:9e:9a:5d:
                    1a:13:d8:c3:db:3d:c8:97:7a:ee:70:ed:a7:e6:7c:
                    db:71:cf:2d:94:62:df:6d:d6:f5:38:be:3f:a5:85:
                    0a:19:b8:a8:d8:09:75:42:70:c4:ea:ef:cb:0e:c8:
                    34:a8:12:22:98:0c:b8:13:94:b6:4b:ec:f0:d0:90:
                    e7:27
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                email:ec_acc@catcert.net
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Key Identifier: 
                A0:C3:8B:44:AA:37:A5:45:BF:97:80:5A:D1:F1:78:A2:9B:E9:5D:8D
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.15096.1.3.1.10
                  CPS: https://www.catcert.net/verarrel
                  User Notice:
                    Explicit Text: Vegeu https://www.catcert.net/verarrel 
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        a0:48:5b:82:01:f6:4d:48:b8:39:55:35:9c:80:7a:53:99:d5:
        5a:ff:b1:71:3b:cc:39:09:94:5e:d6:da:ef:be:01:5b:5d:d3:
        1e:d8:fd:7d:4f:cd:a0:41:e0:34:93:bf:cb:e2:86:9c:37:92:
        90:56:1c:dc:eb:29:05:e5:c4:9e:c7:35:df:8a:0c:cd:c5:21:
        43:e9:aa:88:e5:35:c0:19:42:63:5a:02:5e:a4:48:18:3a:85:
        6f:dc:9d:bc:3f:9d:9c:c1:87:b8:7a:61:08:e9:77:0b:7f:70:
        ab:7a:dd:d9:97:2c:64:1e:85:bf:bc:74:96:a1:c3:7a:12:ec:
        0c:1a:6e:83:0c:3c:e8:72:46:9f:fb:48:d5:5e:97:e6:b1:a1:
        f8:e4:ef:46:25:94:9c:89:db:69:38:be:ec:5c:0e:56:c7:65:
        51:e5:50:88:88:bf:42:d5:2b:3d:e5:f9:ba:9e:2e:b3:ca:f4:
        73:92:02:0b:be:4c:66:eb:20:fe:b9:cb:b5:99:7f:e6:b6:13:
        fa:ca:4b:4d:d9:ee:53:46:06:3b:c6:4e:ad:93:5a:81:7e:6c:
        2a:4b:6a:05:45:8c:f2:21:a4:31:90:87:6c:65:9c:9d:a5:60:
        95:3a:52:7f:f5:d1:ab:08:6e:f3:ee:5b:f9:88:3d:7e:b8:6f:
        6e:03:e4:42

Edit: Educated guess is that it's the negative serial number, which is technically an RFC violation (but one that the RFC recognizes and says consumers SHOULD be prepared to consume.)

[tarcieri]

Yeah, I agree it's the negative serial number. The current SerialNumber type in x509-cert uses a UInt internally.

"Fixing" this would require adding a signed Int type and switching to that as the internal representation of SerialNumber.

We don't currently have a signed Int type because we haven't needed it before.

[woodruffw]

Makes sense. I can work on a proper Int type and the corresponding changes to SerialNumber.