[openssl/openssl] d17f5a: Add documentation for NAME_CONSTRAINTS_check

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: d17f5afdde90b2bd34296516d30e489fe7499043
      https://github.com/openssl/openssl/commit/d17f5afdde90b2bd34296516d30e489fe7499043
  Author: Bob Beck <[email protected]>
  Date:   2026-06-24 (Wed, 24 Jun 2026)

  Changed paths:
    M doc/build.info
    A doc/man3/NAME_CONSTRAINTS_check.pod
    M doc/man3/X509_verify_cert.pod
    M util/missingcrypto.txt

  Log Message:
  -----------
  Add documentation for NAME_CONSTRAINTS_check

We document which names and name constraints will be evaluated
as well as the limits that will be placed on the evauluation on
a per certificate basis.

We call out in the BUGS section that the RFC 5280 requires a byte
per byte match of name constraints unless the higher level protocol
has defines a different matching method for wildcards. This
"deferall of specification" and corresponding lack of specification
by upper level protocols means that across implementations encountering
the default behaviour is to be expected, and that therefore relying
on excluded names to constrain signers in a PKI from signing wildcards
is ill advised.

This is then cross referenced in the documentation for X509_verify_cert
and the maximum possible comparisons which can be forces in a certificate
validtion noted in the BUGS section of X509_verify_cert.

Fixes: https://github.com/openssl/openssl/issues/30706

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Nikola Pajkovsky <[email protected]>
MergeDate: Wed Jun 24 13:03:54 2026
(Merged from https://github.com/openssl/openssl/pull/31334)

(cherry picked from commit 1a65972ad0b5e3a02e33de3cd7bda61764067710)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/481a87-d17f5a%40github.com.