mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
afb281198c
Apply the Name Constraints of every CA in the verified chain to the certificates below it, as in RFC 5280 section 6.1, except self-issued intermediate certificates. Check dNSName, rfc822Name, iPAddress and directoryName against the permitted and excluded subtrees; excluded subtrees take precedence. The names of a certificate are its subject (as a directoryName), the emailAddress attributes of the subject (as rfc822Names) and all its subjectAltNames. An end-entity certificate without subjectAltName is matched against the expected hostname by its CN, so its CNs are checked as dNSNames. A wildcard dNSName is permitted only if all names it stands for are, and excluded if any of them is. Fail closed: a name of a form that the CA constrains but that can't be checked (otherName, URI, x400Address, ediPartyName, registeredID, or a malformed one) violates the constraints. Report violations with the new verify flag MBEDTLS_X509_BADCERT_NAME_CONSTRAINTS on the constrained certificate. Fixes #8759. Signed-off-by: Josef Kolář <josef.kolar@firma.seznam.cz> |
||
|---|---|---|
| .. | ||
| mbedtls | ||
| .gitignore | ||
| CMakeLists.txt | ||