crypto/x509: single-label excluded DNS name constraints incorrectly match all wildcard SANs

[zcayou]

Summary

The fix for CVE-2025-61727 (commit 287017a) introduced a regression where a single-label excluded DNS name constraint (e.g. a TLD) incorrectly causes all wildcard SANs to be rejected.

Go Version

go version go1.25.5 linux/amd64

Environment

This occurs in environments using TLS-inspecting proxies with CA certificates that have Name Constraints excluding TLDs. This is common in TLD-owning entities where PKI hierarchies exclude .<tld> domains to prevent the proxy CA from issuing certificates for that entity.

What did you do?

Attempted to validate a certificate chain where:

1. An intermediate CA has X509v3 Name Constraints with Excluded: DNS:<tld>
2. The leaf certificate has wildcard SANs such as *.aiplatform-notebook.cloud.google.com

Minimal reproduction:

package main

import (
	"crypto/tls"
	"fmt"
)

func main() {
	conf := &tls.Config{ServerName: "sum.golang.org"}
	conn, err := tls.Dial("tcp", "sum.golang.org:443", conf)
	if err != nil {
		fmt.Println("tls.Dial error:", err)
		return
	}
	defer conn.Close()
	fmt.Println("Handshake OK")
}

The above fails when the system trust store includes a CA chain where an intermediate has single-label excluded DNS constraints.

        X509v3 extensions:
            X509v3 Name Constraints: critical
                Excluded:
                  DNS:<tld>

What did you expect to see?

Certificate validation should succeed, or at least not fail due to the TLD's name constraints.

What did you see instead?

tls.Dial error: tls: failed to verify certificate: x509: a root or intermediate certificate is not authorized to sign for this name: DNS name "*.aiplatform-notebook.cloud.google.com" is excluded by constraint "<tld>"

Root Cause Analysis

The bug is in matchDomainConstraint() in src/crypto/x509/verify.go. The CVE-2025-61727 fix in 287017a added logic to handle wildcard SANs against excluded subdomain constraints:

if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 0 {
    domainLabels = domainLabels[:len(domainLabels)-1]
    constraintLabels = constraintLabels[:len(constraintLabels)-1]
}

This logic causes all wildcard SANs to incorrectly match single-label constraints by turning constraintLabels into a zero-length slice, bypassing the subsequent matching loop.

for i, constraintLabel := range constraintLabels {
	if !strings.EqualFold(constraintLabel, domainLabels[i]) {
		return false, nil
	}
}

return true, nil

Related Issues

• crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (CVE-2025-61727) #76442
• crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (CVE-2025-61727) [1.25 backport] #76464
• CVE-2025-61727

[seankhliao]

cc @golang/security

[gopherbot]

Change https://go.dev/cl/739400 mentions this issue: crypto/x509: fix single label excluded name constraints handling

[rolandshoemaker]

@gopherbot please open backport issues.

[gopherbot]

Backport issue(s) opened: #77322 (for 1.24), #77323 (for 1.25).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

[gopherbot]

Change https://go.dev/cl/739420 mentions this issue: crypto/x509: fix single label excluded name constraints handling

[rolandshoemaker]

Backports have all landed, nothing left to do on master so closing.