Merge pull request #811 from neverpanic/cal-allow-keyUsage-nonRepudiation

hslatman · web-flow · commit 1267d9324efb · 2025-08-05T14:41:50.000+02:00
Accept nonRepudiation when unmarshalling keyUsage
diff --git a/x509util/extensions.go b/x509util/extensions.go
@@ -40,6 +40,8 @@ const (
 	KeyUsageCRLSign           = "crlSign"
 	KeyUsageEncipherOnly      = "encipherOnly"
 	KeyUsageDecipherOnly      = "decipherOnly"
+
+	keyUsageNonRepudiation = "nonRepudiation" // old name for contentCommitment
 )
 
 // Names used for extended key usages.
@@ -727,7 +729,9 @@ func (k *KeyUsage) UnmarshalJSON(data []byte) error {
 		switch convertName(s) {
 		case convertName(KeyUsageDigitalSignature):
 			ku = x509.KeyUsageDigitalSignature
-		case convertName(KeyUsageContentCommitment):
+		// support legacy name for better user experience for users coming from
+		// OpenSSL
+		case convertName(KeyUsageContentCommitment), convertName(keyUsageNonRepudiation):
 			ku = x509.KeyUsageContentCommitment
 		case convertName(KeyUsageKeyEncipherment):
 			ku = x509.KeyUsageKeyEncipherment
diff --git a/x509util/extensions_test.go b/x509util/extensions_test.go
@@ -519,6 +519,7 @@ func TestKeyUsage_UnmarshalJSON(t *testing.T) {
 		// Normalized
 		{"DigitalSignature", args{[]byte(`"DigitalSignature"`)}, KeyUsage(x509.KeyUsageDigitalSignature), false},
 		{"ContentCommitment", args{[]byte(`"ContentCommitment"`)}, KeyUsage(x509.KeyUsageContentCommitment), false},
+		{"NonRepudiation", args{[]byte(`"NonRepudiation"`)}, KeyUsage(x509.KeyUsageContentCommitment), false},
 		{"KeyEncipherment", args{[]byte(`"KeyEncipherment"`)}, KeyUsage(x509.KeyUsageKeyEncipherment), false},
 		{"DataEncipherment", args{[]byte(`"DataEncipherment"`)}, KeyUsage(x509.KeyUsageDataEncipherment), false},
 		{"KeyAgreement", args{[]byte(`"KeyAgreement"`)}, KeyUsage(x509.KeyUsageKeyAgreement), false},
@@ -529,6 +530,7 @@ func TestKeyUsage_UnmarshalJSON(t *testing.T) {
 		// Snake case
 		{"digital_signature", args{[]byte(`"digital_signature"`)}, KeyUsage(x509.KeyUsageDigitalSignature), false},
 		{"content_commitment", args{[]byte(`"content_commitment"`)}, KeyUsage(x509.KeyUsageContentCommitment), false},
+		{"non_repudiation", args{[]byte(`"non_repudiation"`)}, KeyUsage(x509.KeyUsageContentCommitment), false},
 		{"key_encipherment", args{[]byte(`"key_encipherment"`)}, KeyUsage(x509.KeyUsageKeyEncipherment), false},
 		{"data_encipherment", args{[]byte(`"data_encipherment"`)}, KeyUsage(x509.KeyUsageDataEncipherment), false},
 		{"key_agreement", args{[]byte(`"key_agreement"`)}, KeyUsage(x509.KeyUsageKeyAgreement), false},
