When considering if a excluded constraint applies to a wildcard SAN, we are being overly broad in the old name constraint matching logic that still exists in 1.25.
If we have an excluded constraint for bar.com, we consider *.foo.com excluded.
Since this is overly restrictive, rather than overly lax, we do not consider this a security issue.
When considering if a excluded constraint applies to a wildcard SAN, we are being overly broad in the old name constraint matching logic that still exists in 1.25.
If we have an excluded constraint for
bar.com, we consider*.foo.comexcluded.Since this is overly restrictive, rather than overly lax, we do not consider this a security issue.