检查X509证书是否与CertificateRequest（CSR）匹配

Question

How can I check if a x509 certificate matches a CSR (if the certificate was generated based on a specific CSR) in Go? Do I need to generate a new certificate from the CSR and compare them?

Answer 1

If your signing request is in the DER format there's a couple of functions in the standard library you can use; first to parse the CSR (https://golang.org/pkg/crypto/x509/#ParseCertificateRequest) and then the certificate (https://golang.org/pkg/crypto/x509/#ParseCertificate). Once parsed you can compare the public key values.

Standard but important security note:

Please note that this DOES NOT validate the certificate in anyway. It may or may not be safe to use, and could have been substituted or altered.