crypto/x509: reject end-entity certs w/ name constraint ext.

[cpu]

RFC 5280 §4.2.1.10 when spec'ing Name Constraints for the 5280 profie says:

The name constraints extension, which MUST be used only in a CA certificate

This is tested by the x509-limbo rfc5280::nc::not-allowed-in-ee-noncritical and rfc5280::nc::not-allowed-in-ee-critical testcases.

Go crypto/x509 should enforce these requirements when verifying a leaf certificate so that the x509-limbo test cases produce the expected results.

Separately, it may be worth considering whether the x509.CreateCertificate function should also be updated to error if the provided template includes name constraints, but is not a CA certificate.

Relates to #65085 https://go-review.googlesource.com/c/go/+/783980

[gabyhelp]

Related Issues

• crypto/x509: don't apply name constraints to non-terminal self-issued certs #79746
• crypto/x509: Certificate.Verify does not enforce name constraints correctly #59171 (closed)
• crypto/x509: reject non-profile minimum/maximum in GeneralSubtree name constraints #77826
• crypto/x509: Verify should error if non-CA certificate contains name constraints #71795
• crypto/x509: tighten up SAN criticality handling #79741
• crypto/x509: don't count self-signed certs in pathlen budget #79745
• crypto/x509: support DirectoryName name constraints #15196
• crypto/x509: enforce Name Constraints on intermediates with SANs #45856 (closed)

Related Code Changes

• crypto/x509: Adding Name Constraints
• crypto/x509: enforce all name constraints and support IP, email and URI constraints

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[mrkfrmn]

cc @golang/security