• Filippo Valsorda's avatar
    crypto/x509: ignore Common Name when it does not parse as a hostname · 4f9ec2c7
    Filippo Valsorda authored
    The Common Name is used as a hostname when there are no Subject
    Alternative Names, but it is not restricted by name constraints. To
    protect against a name constraints bypass, we used to require SANs for
    constrained chains. See the NameConstraintsWithoutSANs error.
    
    This change ignores the CN when it does not look like a hostname, so we
    can avoid returning NameConstraintsWithoutSANs.
    
    This makes it possible to validate certificates with non-hostname CN
    against chains that use name constraints to disallow all names, like the
    Estonian IDs.
    
    Updates #24151
    
    Change-Id: I798d797990720a01ad9b5a13336756cc472ebf44
    Reviewed-on: https://go-review.googlesource.com/123355Reviewed-by: 's avatarAdam Langley <agl@golang.org>
    4f9ec2c7
x509.go 80.9 KB