crypto/x509: Fails to parse certificates with fully qualified domain names

[hanikesn]

After recompiling our code with 1.10 it fails to parse certificates including fully qualified domain names (with a . at the end).

tls: failed to parse certificate from server: x509: cannot parse dnsName "master.test.local."

This seems to be related to #23995 and introduced by: #15196

[ianlancetaylor]

CC @FiloSottile @agl

[FiloSottile]

Trailing dots are not allowed in dnsName, so this is a duplicate of #23711 since the dnsName issue is in the leaf. However, it would be fixed by the #23995 patch, because it would only invoke parsing when checking name constraints, so I'll count it as a +1 on there. (I do wonder why matchHostnames supports them.)

From RFC 5280:

The name MUST be in the "preferred name syntax", as specified by
Section 3.5 of [RFC1034] and as modified by Section 2.1 of
[RFC1123].