{"record":{"id":"bf2caea58f3a3da1","repo":"shadow1ng/fscan","slug":"unmarshal-public-key-info-w","errorCode":null,"errorMessage":"unmarshal public key info: %w","messagePattern":"unmarshal public key info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"libs/grdp/protocol/t125/gcc/gcc.go","lineNumber":424,"sourceCode":"}\n\nfunc (x *X509CertificateChain) GetPublicKey() (*rsa.PublicKey, error) {\n\tif len(x.CertBlobArray) == 0 {\n\t\treturn nil, errors.New(\"empty certificate chain\")\n\t}\n\tdata := x.CertBlobArray[len(x.CertBlobArray)-1].AbCert\n\tcert, err := x509.ParseCertificate(data)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse certificate: %w\", err)\n\t}\n\tif cert.PublicKey == nil {\n\t\tvar pubKeyInfo struct {\n\t\t\tAlgorithm        pkix.AlgorithmIdentifier\n\t\t\tSubjectPublicKey asn1.BitString\n\t\t}\n\t\t_, err = asn1.Unmarshal(cert.RawSubjectPublicKeyInfo, &pubKeyInfo)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unmarshal public key info: %w\", err)\n\t\t}\n\t\trsaPublicKey, err := x509.ParsePKCS1PublicKey(pubKeyInfo.SubjectPublicKey.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"parse PKCS1 public key: %w\", err)\n\t\t}\n\t\treturn rsaPublicKey, nil\n\t}\n\trsaPublicKey, ok := cert.PublicKey.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"unsupported public key type: %T\", cert.PublicKey)\n\t}\n\treturn rsaPublicKey, nil\n}\nfunc (x *X509CertificateChain) Verify() bool {\n\treturn true\n}\nfunc (x *X509CertificateChain) Encrypt() []byte {\n\t//todo","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/t125/gcc/gcc.go#L406-L442","documentation":"This fallback path runs when cert.PublicKey is nil. The library re-parses the certificate's RawSubjectPublicKeyInfo via asn1.Unmarshal into an algorithm/bitstring struct; if that ASN.1 decode fails, it returns 'unmarshal public key info: %w'.","triggerScenarios":"The parsed certificate has no PublicKey but its RawSubjectPublicKeyInfo bytes are malformed or in an algorithm/structure the struct does not match (e.g. unusual parameter encoding in AlgorithmIdentifier).","commonSituations":"Exotic or legacy RDP server certificates with unusual SPKI encodings; certificates using algorithms outside RSA that don't populate cert.PublicKey in the expected way after the initial parse.","solutions":["Inspect the certificate with openssl: `openssl x509 -inform der -in cert.der -text` to see its SPKI algorithm.","Confirm the SPKI is actually RSA; EC/other keys need different parsing (x509.ParsePKIXPublicKey).","Update the Go toolchain — newer crypto/x509 versions handle more SPKI encodings.","Regenerate/use a standard RSA server certificate on the RDP host if you control it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"pub, err := certChain.PublicKey()\nif err != nil && strings.Contains(err.Error(), \"unmarshal public key info:\") {\n\treturn fmt.Errorf(\"certificate SPKI not parseable by this Go version: %w\", err)\n}","preventionTips":["Run a recent Go toolchain (crypto/x509 gains SPKI tolerance over time).","Verify server certs are standard RSA X.509 certificates.","Inspect SPKI algorithm with openssl when debugging.","Standardize RDP host certificates if you manage the servers."],"tags":["asn1","x509","parsing","rdp"],"backgroundTag":"schema-validation-failed","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}