crypto/x509: unwrap Subject Key Identifier

RFC 5280, 4.2.1.2 says:
  SubjectKeyIdentifier ::= KeyIdentifier
  KeyIdentifier ::= OCTET STRING

Previously, we were failing to unwrap the second level of OCTET STRING
encoding.

Fixes #993.

R=rsc
CC=golang-dev
https://golang.org/cl/1917044

src/pkg/crypto/x509/x509.go

@@ -610,7 +610,12 @@ func parseCertificate(in *certificate) (*Certificate, os.Error) {
 
 			case 14:
 				// RFC 5280, 4.2.1.2
-				out.SubjectKeyId = e.Value
+				var keyid []byte
+				_, err = asn1.Unmarshal(&keyid, e.Value)
+				if err != nil {
+					return nil, err
+				}
+				out.SubjectKeyId = keyid
 				continue
 			}
 		}