How to create certificate with undefined validity period

Question

If I omit the attribute NotAfter during initialisation of an x509.Certificate, it results in the expiry date being set to "0001-01-01", thus making the certificate expired.

In PHP + phpseclib, I can skip setting this field, making the issued certificate never expire. Is it possible to do this in Go?

RFC 5280 states:

4.1.2.5. Validity To indicate that a certificate has no well-defined expiration date, the notAfter SHOULD be assigned the GeneralizedTime value of 99991231235959Z.

How can I do this in Go?

Answer 1

TL;DR: Neither NotBefore nor NotAfter is optional. You must be mistaken about your Python PHP script. I would assume it uses some kind of default value for NotAfter if you don't specify it.

crypto/x509 defines the Validity as follows:

type validity struct {
    NotBefore, NotAfter time.Time
}

Since neither field is a pointer, they cannot be undefined.

If you want to force the issue, you can use a modified copy of the x509 types to encode a certificate without the NotAfter field, but the result is unusable. Playground link

package main

import (
        "crypto/ecdsa"
        "crypto/elliptic"
        "crypto/rand"
        "crypto/x509"
        "crypto/x509/pkix"
        "encoding/asn1"
        "encoding/pem"
        "log"
        "math/big"
        "os"
        "time"
)

// copy of x509.certificate, with TBSCertificate.Validity.NotAfter omitted
type certificate struct {
        TBSCertificate struct {
                Version            int `asn1:"optional,explicit,default:0,tag:0"`
                SerialNumber       *big.Int
                SignatureAlgorithm pkix.AlgorithmIdentifier
                Issuer             asn1.RawValue
                Validity           struct {
                        NotBefore time.Time
                }
                Subject   asn1.RawValue
                PublicKey struct {
                        Raw       asn1.RawContent
                        Algorithm pkix.AlgorithmIdentifier
                        PublicKey asn1.BitString
                }
                UniqueId        asn1.BitString   `asn1:"optional,tag:1"`
                SubjectUniqueId asn1.BitString   `asn1:"optional,tag:2"`
                Extensions      []pkix.Extension `asn1:"optional,explicit,tag:3"`
        }
        SignatureAlgorithm pkix.AlgorithmIdentifier
        SignatureValue     asn1.BitString
}

func main() {
        derBytes := generateSelfSigned()

        // re-marshal to remove the NotAfter field
        var c certificate
        _, err := asn1.Unmarshal(derBytes, &c)
        check(err)

        derBytes, err = asn1.Marshal(c)
        check(err)

        pem.Encode(os.Stdout, &pem.Block{
                Type:  "CERTIFICATE",
                Bytes: derBytes,
        })
}

func generateSelfSigned() (derBytes []byte) {
        pk, err := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
        check(err)

        tpl := &x509.Certificate{SerialNumber: big.NewInt(1)}

        derBytes, err = x509.CreateCertificate(rand.Reader, tpl, tpl, &pk.PublicKey, pk)
        check(err)

        return derBytes
}

func check(err error) {
        if err != nil {
                log.Fatal(err)
        }
}

If you hand one of these certificates to openssl, for instance, parsing fails as expected with

unable to load certificate

139990566643520:error:0D078079:asn1 encoding routines:asn1_item_embed_d2i:field missing:crypto/asn1/tasn_dec.c:389:Field=notAfter, Type=X509_VAL