Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

display and parse inconsistency with DNS SubjectAltNames #123

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

duritong
Copy link

@duritong duritong commented Feb 8, 2017

As soon as a certificate has more than one (DNS?) SAN, jruby-openssl

a) represents them internally as multiple extensions
b) the to_text also renders them as multiple entries

However, as far as I understand https://tools.ietf.org/html/rfc5280#section-4.2
an extension MUST only appear once: "A certificate MUST NOT include
more than one instance of a particular extension.", which means
that the representation like it is now is at least misleading,
if not even completely wrong. MRI openssl returns for the same
certificate only one extension, matching a string that is also
expected in the other SAN test case.

This especially breaks any kind of client tools that are looking
for the first extension and then try to match that content.
Also the test shows an inconsistency before and after parsing.

As soon as a certificate has more than one (DNS?) SAN, jruby-openssl

a) represents them internally as multiple extensions
b) the `to_text` also renders them as multiple entries

However, as far as I understand https://tools.ietf.org/html/rfc5280#section-4.2
an extension MUST only appear once: "A certificate MUST NOT include
more than one instance of a particular extension.", which means
that the representation like it is now is at least misleading,
if not even completely wrong. MRI openssl returns for the same
certificate only one extension, matching a string that is also
expected in the other SAN test case.

This especially breaks any kind of client tools that are looking
for the *first* extension and then try to match that content.
Also the test shows an inconsistency before and after parsing.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants