VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint Inconsistency in RFC 5280 Implementation
Imported from official source
This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. The observed differences concern DNS name comparison, IP address handling, URI-authority parsing, and wildcard matching. …
This version
- Version
- 1 of 2
- Recorded
- October 13, 2026 19:00
- Change
- Initial
- Content hash
7a2e9af3e652fd157cb80cc9caada327- All versions
- Revision history