The x509sha1 GODEBUG setting has been removed with go1.24, tests relying on sha1 certificates will fail when running with >= go1.24

[mitch292]

Release notes can be found here: https://tip.golang.org/doc/go1.24

[elukey]

I am facing this problem when trying to package cfssl for Debian Trixie (that ships with golang 1.24). I applied https://patch-diff.githubusercontent.com/raw/cloudflare/cfssl/pull/1410.patch and the failures got down to:

2026/02/17 12:57:46 [INFO] bundling certificate for CN=cloudflare-leaf.com,OU=Systems Engineering,O=CloudFlare,L=San Francisco,ST=California,C=US
2026/02/17 12:57:46 [WARNING] bad PEM certificate or private key
2026/02/17 12:57:46 [INFO] 127.0.0.1:59016 - "POST /" 1220
--- FAIL: TestBundle (0.03s)
    bundle_test.go:190: Test 0: expected: 200, have 400
    bundle_test.go:191: 400 Bad Request 200 {"success":false,"result":null,"errors":[{"code":1220,"message":"x509: certificate signed by unknown authority (possibly because of \"x509: cannot verify signature: insecure algorithm SHA1-RSA\" while trying to verify candidate authority certificate \"CFSSL_TEST_CA\")"}],"messages":[]}

That seems to be related to the api/testdata/int-bundle.pem file/intermediate, so I guess that the pem needs to be regenerated with sha256 signing and all the leaf certs reissued.

[elukey]

I am not sure if I am reading it right, but int-bundle has the following as issuer:

Issuer: C=US, ST=California, L=San Francisco, O=CloudFlare, OU=DEV_TESTING, CN=CFSSL_TEST_CA

And I found the CN only in ubiquity/testdata/rsa1024sha1.pem, that is clearly not good (because of sha1).

[elukey]

@mitch292 Hi! Do you have any suggestion about how's best to proceed? My understanding is that rsa1024sha1.pem needs to be removed, and the intermediate/leaf depending on it regenerated with something different (maybe another TEST ca without sha1). There are also probably some sha1-specific tests to remove as well with golang 1.24.. I can work on a patch but I am a bit lost about how all the certs are related with each other (is the ubiquity's testdata dir used as collection of Root CAs to use when the intermediate/leaf certs don't have the root CA bundled?)

[mitch292]

Can you install an earlier go version? Or are you asking how to proceed to fix the issue?

[elukey]

@mitch292 I cannot since I am trying to build cfssl with some custom patches (PRs not yet merged) for Debian Trixie, that ships with golang 1.24. The build succeeds, but running the tests fails due to the aforementioned reasons. I'd like to possibly remove the sha1 signing occurrences in the testdata files and leave a PR open, to do a complete testing on golang 1.24 and also to allow others to benefit from this. Lemme know your thoughts :)

[mitch292]

@elukey yes definitely open to a PR! Thank you!

[elukey]

@mitch292 ack will do! As far of my proposal earlier on, does it make sense? I am not 100% sure how the testdata is connected (root CAs, intermediates, leafs) - is the ubiquity directory and related CA testdata certs included elsewhere? For example, the following two certs need to be fixed:

api/testdata/int-bundle.pem (intermediate CA - sha1 signing)
api/testdata/leaf.pem (signed by the above intermediate)

From a quick inspection of int-bundle.pem with openssl, the CA signing it is CN=CFSSL_TEST_CA, and I only found it in ubiquity/testdata/rsa1024sha1.pem. There are probably more, but knowing how the testdata was structured would help the PR.

Thanks in advance!

[mitch292]

@elukey - I am not sure how the test data is structured offhand I would have to dig into it. Could maybe start with that single chain and get the tests running locally against go 1.24 and see if there are more failures. I'll try to take a deeper look when I have time.

[elukey]

Fixed the first bit, now I have more :D

2026/02/19 15:31:50 [INFO] bundling certificate for CN=cloudflare-leaf.com,OU=Systems Engineering,O=CloudFlare,L=San Francisco,ST=California,C=US
--- FAIL: TestBundleFromFile (0.04s)
    bundle_from_file_test.go:356: expected no error bundling "testdata/cfssl-leaf-ecdsa256.pem". but an error occurred: {"code":1220,"message":"x509: certificate signed by unknown authority (possibly because of \"x509: cannot verify signature: insecure algorithm SHA1-RSA\" while trying to verify candidate authority certificate \"CFSSL_TEST_CA\")"}
2026/02/19 15:31:50 [INFO] bundling certificate for SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
--- FAIL: TestBundleFromPEM (0.32s)
    bundle_from_pem_test.go:77: expected no error. but an error occurred at 0-th test: {"code":1220,"message":"x509: certificate signed by unknown authority (possibly because of \"x509: cannot verify signature: insecure algorithm SHA1-RSA\" while trying to verify candidate authority certificate \"The Go Daddy Group, Inc.\")"}
    bundler_test.go:865: Cert bundle should have a chain of length 1. Got nil.
2026/02/19 15:31:51 [INFO] bundling certificate for CN=*.badssl.com

2026/02/19 15:32:08 [INFO] bundling certificate for CN=cloudflare-leaf.com,OU=Systems Engineering,O=CloudFlare,L=San Francisco,ST=California,C=US
--- FAIL: TestChromeWarning (0.02s)
    bundler_sha1_deprecation_test.go:51: bundling failed:  {"code":1220,"message":"x509: certificate signed by unknown authority (possibly because of \"x509: cannot verify signature: insecure algorithm SHA1-RSA\" while trying to verify candidate authority certificate \"CFSSL_TEST_CA\")"}
--- FAIL: TestSHA2Preferences (0.00s)
    bundler_sha1_deprecation_test.go:149: {"code":2003,"message":"Failed to parse private key"}
2026/02/19 15:32:08 [ERROR] root bundle failed to load: open testdata/no_such_file.pem: no such file or directory
2026/02/19 15:32:08 [ERROR] intermediate bundle failed to load: open testdata/no_such_file.pem: no such file or directory
2026/02/19 15:32:09 [INFO] bundling certificate for SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US
--- FAIL: TestBundleMarshalJSON (0.31s)
    bundler_test.go:104: bundle is empty.
2026/02/19 15:32:09 [INFO] bundling certificate for CN=cloudflare-leaf.com,OU=Systems Engineering,O=CloudFlare,L=San Francisco,ST=California,C=US
--- FAIL: TestBundleWithECDSAKeyMarshalJSON (0.01s)

Will update the issue when I make progress.

[elukey]

@mitch292 Hi! I tried to move forward but it is not straightforward to navigate the dependencies between certs and what values they need to carry to match what's written inside the tests (plus some certs are expired, some about to expire, most of them signed with sha1 etc..). I think that the sane way to do this would be to restructure the generation of the testdata dirs with a script, that possibly uses cfssl json configs to regenerate the same data. Once we do it, then fixing the certs in the future may become way easier, because it is bound to happen again.

[mitch292]

@elukey Appreciate the work here! I agree something like that will be more maintainable. In the interim, can we add a build tag to the test files giving you troubles? Something like below should tell go not to build the files on version go1.24 or later. Does that work?
//go:build !go1.24