Complete and correct support for directoryName constraints
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 160
- Forks
- 102
- Avg merge
- 28m
- Merged PRs (30d)
- 5
Description
Just to record: this and the parent repo do not correctly process directoryName name constraints. The easier reproducer for this is (in rustls):
$ ./target/debug/tlsclient-mio --http www.indicepa.gov.it
TLS error: InvalidCertificateData("invalid peer certificate: UnknownIssuer")
The issuer here is https://crt.sh/?id=5715019745&opt=cablint,x509lint,zlint and we're incorrectly processing the constraint against the end-certificate subject. There seems to be a lack of code that dissects the subject into name attributes, and no code at all for comparing sets of DN attributes for equality?
golang has the same issue https://github.com/golang/go/issues/55872
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with rustls's tlsclient-mio command and inspect the directoryName constraint handling in the certificate-validation code. Compare the issuer constraint with the certificate subject's name attributes, using the crt.sh certificate as a case study; done means the reported certificate validates correctly without regressing other directoryName checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100