[openssl/openssl] 00565b: Stop consulting the subject DN by default in X509 ...

  Branch: refs/heads/master
  Home:   https://github.com/openssl/openssl
  Commit: 00565bb35cbaddad3fdd9c2a00d6ae360b7161f5
      https://github.com/openssl/openssl/commit/00565bb35cbaddad3fdd9c2a00d6ae360b7161f5
  Author: Bob Beck <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M CHANGES.md
    M crypto/x509/v3_utl.c
    M doc/man3/X509_VERIFY_PARAM_set1_host.pod
    M doc/man3/X509_VERIFY_PARAM_set_hostflags.pod
    M doc/man3/X509_check_host.pod
    M test/v3nametest.c

  Log Message:
  -----------
  Stop consulting the subject DN by default in X509 name checks

do_x509_check() now matches the subject commonName (host checks) and
emailAddress (email checks) only when X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
is set, rather than whenever no matching subjectAltName is present.

Update v3nametest to request ALWAYS_CHECK_SUBJECT for its subject-DN cases.

Fixes: openssl/project#1897

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Wed Aug 26 15:21:48 2026
(Merged from https://github.com/openssl/openssl/pull/31982)


  Commit: e7f3a42c237558214d0ca47b80e0465acd2fe9a7
      https://github.com/openssl/openssl/commit/e7f3a42c237558214d0ca47b80e0465acd2fe9a7
  Author: Bob Beck <[email protected]>
  Date:   2026-08-26 (Wed, 26 Aug 2026)

  Changed paths:
    M CHANGES.md
    M crypto/x509/x509_vfy.c
    M doc/man3/X509_VERIFY_PARAM_set_hostflags.pod
    M test/recipes/25-test_verify.t

  Log Message:
  -----------
  Apply DNS name constraints to the subject CN only when it may match

Now that the subject DN is not consulted for host checks by default,
call NAME_CONSTRAINTS_check_CN() on the leaf only under
X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT - matching the verify logic

Reviewed-by: Tomas Mraz <[email protected]>
Reviewed-by: Andrew Dinh <[email protected]>
MergeDate: Wed Aug 26 15:21:53 2026
(Merged from https://github.com/openssl/openssl/pull/31982)


Compare: https://github.com/openssl/openssl/compare/6bfa751d0e38...e7f3a42c2375

To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/master/6bfa75-e7f3a4%40github.com.