Google BoringSSL Name Constraints Bypass in SAN Validation Logic

Overview Five Name Constraints findings in BoringSSL VU410595.8–.12 describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, a...