crypto/x509: Partial wildcards are not supported

[agunnerson-ibm]

What version of Go are you using (go version)?

go version go1.11 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOCACHE="/home/chenxiaolong/.cache/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/chenxiaolong/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/lib/go"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build053678865=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Tried validating a certificate that uses partial wildcards (eg. foo*.example.com) against a hostname (eg. foobar.example.com).

What did you expect to see?

The hostname/SubjectAltName validation should succeed.

What did you see instead?

The validation fails because the optional RFC 6125, section 6.4.3, rule 3 is not implemented.

[gopherbot]

Change https://golang.org/cl/134715 mentions this issue: crypto/x509: Add support for partial wildcard matching (RFC6125 6.4.3)

[agunnerson-ibm]

I submitted a PR to implement this since we're looking to use certificates with partial wildcards and it seems that other common tools/libraries implement this too. For example:

• https://github.com/ruby/openssl/blob/62436385306c7f3d97351b9108d1e571a847287b/test/test_ssl.rb#L555
• https://github.com/curl/curl/blob/11e8a43f853b9bf050db58f073e6f2411821ce60/lib/hostcheck.c#L66

[agunnerson-ibm]

Closing per @agl's explanation in the Gerrit PR:

Thank you for the effort, but this isn't something that we would want to support I'm afraid.

We (being the wider PKI community) have worked hard to define and constrain wildcards, which were fairly wild (excuse the pun) for a long time, because differences in interpretations of wildcards between systems is dangerous.

Now wildcards are defined in the Baseline[1] as "A Domain Name consisting of a single asterisk character followed by a single full stop character (“*.”) followed by a Fully-Qualified Domain Name.". That's the complete definition that clients should support.

[1] https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.6.0.pdf