Skip to content

v0.1.3 — name constraints + policy check

Choose a tag to compare

View all tags
@milkway milkway released this 14 Jun 23:25
· 38 commits to main since this release
v0.1.3
7be4205

Extends certificate-path validation with two more RFC 5280 features:

  • Name constraints (§4.2.1.10): permitted/excluded subtrees from the CAs above a certificate are enforced against its subject DN and SANs (DirectoryName, DNS, email, IP, URI). Excluded takes precedence over permitted.
  • Required-policy check: TrustStore::require_policy(oid) — the leaf (and any intermediate carrying a policies extension) must assert that policy OID or anyPolicy.

Honest scope: this is a practical subset of RFC 5280 §6.1 policy processing. The full policy engine — valid_policy_tree, policy mapping, requireExplicitPolicy/inhibitPolicyMapping — is deliberately not implemented, because a half-correct policy engine is a security hazard. Name constraints, by contrast, are implemented in full for the common GeneralName types.

New tests cover permitted/excluded names and present/absent required policy.

Assets 2
Loading