Skip to main content

CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries

Source Decision Insights Threat Desk Published October 13, 2026 Companies 2
Human View Machine View

2 companies named, one of 5 articles referencing OpenSSL. Previous coverage: Netskope Adds PQC key exchange support to Next Gen SWG (Aug 2026).

Companies mentioned

Best suited for

Seniority
Architect
Job function
Cybersecurity / Security Architect
Persona
Security Architect
Buyer role
Architect / Technical Evaluator
Decision stage
How to start
Adoption curve
Early Majority
Technology maturity
Established Technology
Industry
Information Technology / Cybersecurity / Identity Security / Machine Identity & Certificate Lifecycle Management

Our classification, not the publisher's statement. Best suited for, not only for.

CERT/CC has published a vulnerability note describing inconsistent handling of X.509 Name Constraints across TLS libraries, where a certificate accepted by one library may be rejected by another. Some of those differences are defects, while others follow from behavior RFC 5280 does not fully specify. Affected projects named in the note include Go, OpenSSL, Apple, LibreSSL, pyca/cryptography, and wolfSSL.

RFC 5280 calls for case-insensitive DNS name matching, and GnuTLS compared some names case-sensitively when reported, tracked as CVE-2026-3833 and fixed in version 3.8.13. A separate Go report concerns case handling in wildcard parent-constraint lookup rather than ordinary hostname comparison. RFC 5280 defines separate IPv4 and IPv6 encodings without stating whether IPv4-mapped IPv6 addresses count as IPv4, so some libraries treat the forms as different and a constraint written for one may not apply to the other.

RFC 3986 permits optional userinfo before the host; implementations differ on the host extracted when an @, colon, query, or fragment is present. Most implementations handle a well-formed single @ per RFC 3986. OpenSSL merged PR #30319 for an @ in the path, query, or fragment; a separate userinfo-colon report is not covered. Wildcard SAN semantics are undefined in RFC 5280; LibreSSL and wolfSSL have wildcard-related reports. pyca/cryptography checked DNS Name Constraints against SANs but not the requested peer name, tracked as CVE-2026-34073 and fixed in 46.0.6.

Abuse depends on a trusted signature over chosen certificate fields, a reachable affected validation path, and an application that relies on the accepted identity for authorization. Validator disagreement alone does not establish exploitation. Mixed service-mesh, CDN, or enterprise PKI environments may see different results for the same certificate, and detection is difficult because the certificate can be validly signed.

CERT/CC is coordinating with Go's crypto/x509, Apple's Security.framework, OpenSSL, LibreSSL, pyca/cryptography, and wolfSSL. Supporting materials include test corpus v3.0.1 and VENDOR_MATRIX_2026-09-06.json, available to case participants, with public links to follow agreed disclosure arrangements.

Operators needing high-assurance Name Constraints should test the validator they currently run against their deployment requirements, apply available updates, and keep leaf certificates to explicit SANs (Subject Alternative Names). A second validator helps only when it uses the same inputs and fails closed, and issuance policy and application-layer allow-lists remain useful complements where libraries differ. Oleh Konko is credited with discovering and reporting these issues. The note was prepared with AI assistance by Timur Snoke.

Blog post, originally published by Timur Snoke at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/",
        "name": "CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/openssl/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/openssl/",
      "name": "OpenSSL"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Architect / Technical Evaluator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Established Technology"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Identity Security / Machine Identity & Certificate Lifecycle Management"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-10-13T13:43:24-06:00",
    "datePublished": "2026-10-13T13:43:19-06:00",
    "description": "CERT/CC reports that TLS libraries, including Go, OpenSSL, Apple, LibreSSL, pyca/cryptography and wolfSSL, interpret X.509 Name Constraints inconsistently.",
    "headline": "CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Timur Snoke"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/573195"
    },
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/",
      "@type": "WebPage",
      "sdDatePublished": "2026-10-13",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/openssl/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/openssl/",
        "name": "OpenSSL"
      },
      {
        "@id": "https://decisioninsights.ai/registry/sans-institute/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/sans-institute/",
        "name": "SANS Institute"
      },
      {
        "@id": "https://decisioninsights.ai/projects/ietf-tls-protocol/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/ietf-tls-protocol/",
        "name": "IETF TLS Protocol"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "LibreSSL"
      },
      {
        "@id": "https://decisioninsights.ai/projects/matrix/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/matrix/",
        "name": "Matrix"
      },
      {
        "@id": "https://decisioninsights.ai/projects/openssl/#project",
        "@type": "SoftwareSourceCode",
        "mainEntityOfPage": "https://decisioninsights.ai/projects/openssl/",
        "name": "OpenSSL"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages