VU#573195: Go, OpenSSL, Apple, LibreSSL, pyca, wolfSSL Name-Constraint inconsistency in RFC 5280 implementation
Imported from official source
This note covers differences in how TLS libraries interpret X.509 Name Constraints. A certificate that one library accepts may be rejected by another. Some of those differences are defects; others follow from behavior that RFC 5280 does not fully specify. The observed differences concern DNS name comparison, IP address handling, URI-authority parsing, and wildcard matching. …
This version
- Version
- 2 of 2
- Recorded
- October 27, 2026 15:00
- Change
- Imported change
- Content hash
5f5c6b3994aaa9d6968295ac1bc4cfd2- All versions
- Revision history