crypto/x509: ParseRevocationList accepts two AKI extensions

[onepeople158]

Go version

go version go1.24.1 linux/amd64

Output of go env in your module/workspace:

Extension OID: 2.5.29.35
Key Identifier: ef69e0f7d51de699ecdc6dd0f7e2b95c64718335
No Authority Cert Issuer
No Authority Cert Serial Number
Extension OID: 2.5.29.20
Extension OID: 2.5.29.35
Key Identifier: ef69e0f7d51de699ecdc6dd0f7e2b95c64718335
No Authority Cert Issuer
No Authority Cert Serial Number

What did you do?

Go successfully parsed the AKI extension information from a CRL file that contains two AKI extensions. However, this test case does not comply with the RFC 5280 specification, which states that a specific extension can only have one instance.

What did you see happen?

Go successfully parsed the AKI extension information from a CRL file that contains two AKI extensions.

What did you expect to see?

crl_two_aki.zip

[dmitshur]

CC @golang/security.