-
Filippo Valsorda authored
The Common Name is used as a hostname when there are no Subject Alternative Names, but it is not restricted by name constraints. To protect against a name constraints bypass, we used to require SANs for constrained chains. See the NameConstraintsWithoutSANs error. This change ignores the CN when it does not look like a hostname, so we can avoid returning NameConstraintsWithoutSANs. This makes it possible to validate certificates with non-hostname CN against chains that use name constraints to disallow all names, like the Estonian IDs. Updates #24151 Change-Id: I798d797990720a01ad9b5a13336756cc472ebf44 Reviewed-on: https://go-review.googlesource.com/123355Reviewed-by:
Adam Langley <agl@golang.org>
4f9ec2c7
Name |
Last commit
|
Last update |
---|---|---|
.github | ||
api | ||
doc | ||
lib/time | ||
misc | ||
src | ||
test | ||
.gitattributes | ||
.gitignore | ||
AUTHORS | ||
CONTRIBUTING.md | ||
CONTRIBUTORS | ||
LICENSE | ||
PATENTS | ||
README.md | ||
favicon.ico | ||
robots.txt |