Make dnsName handling more strict
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
The dnsName (use DNS in the following to represent) should be in ia5string type, which uses the ASCII set. However, the OpenSSL can allow a certificate containing Unicode characters in the DNS attribute instead of rejecting the cert in the parsing stage or failing the verification.
@vdukhovni said:
The certificate still has to match the user's choice of reference
identifier. If, despite the specification, in some applications UTF8 is
expected in DNS name SANs, there is little harm in matching the same
Unicode string in the presented identifier. This could be the case with
some internal "enterprise" applications. Public CAs will presumably not
issue certificates in violation of the rules, and again, I don't see an
actual security issue, just a technical violation of the spec.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Start by tracing how certificate DNS attributes are parsed and later used for verification, then inspect existing certificate-name tests. Done means the handling of Unicode DNS names follows the specified ASCII-only behavior without breaking any explicitly supported matching case.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100