CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries
This is the page you're already on — the Human View toggle above shows it in full.
A green key on the record, left, is one Decision Insights added. It doesn't exist on the company's site or in a wire feed. The same key labels its row on the right, so you can match them directly. More on how DI enriches a record.
This is what the machine sees: the exact JSON-LD an agent receives for this listing.
{
"@context": "https://schema.org",
"@id": "https://decisioninsights.ai/#website",
"@type": "WebSite",
"name": "Decision Insights",
"potentialAction": {
"@type": "SearchAction",
"target": {
"@type": "EntryPoint",
"urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}\u0026submit=1"
}
},
"publisher": {
"@id": "https://decisioninsights.ai/#organization"
},
"url": "https://decisioninsights.ai"
}
{
"@context": "https://schema.org",
"@id": "https://decisioninsights.ai/#organization",
"@type": "Organization",
"contactPoint": {
"@type": "ContactPoint",
"contactType": "customer support",
"email": "[email protected]"
},
"description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
"logo": {
"@type": "ImageObject",
"url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
},
"name": "Decision Insights",
"parentOrganization": {
"@type": "Organization",
"name": "Wiretap Labs",
"sameAs": [
"https://www.linkedin.com/company/wiretap-labs",
"https://www.crunchbase.com/organization/wiretap-labs"
],
"url": "https://wiretaplabs.com"
},
"publishingPrinciples": "https://decisioninsights.ai/standards/",
"sameAs": [
"https://www.linkedin.com/company/decisioninsights"
],
"url": "https://decisioninsights.ai"
}
{
"@context": "https://schema.org",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"item": "https://decisioninsights.ai",
"name": "Decision Insights",
"position": 1
},
{
"@type": "ListItem",
"item": "https://decisioninsights.ai/records/",
"name": "Records",
"position": 2
},
{
"@type": "ListItem",
"item": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/",
"name": "CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries",
"position": 3
}
]
}
{
"@context": "https://schema.org",
"@id": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/#blogposting",
"@type": "BlogPosting",
"about": {
"@id": "https://decisioninsights.ai/registry/openssl/#organization",
"@type": "Organization",
"mainEntityOfPage": "https://decisioninsights.ai/registry/openssl/",
"name": "OpenSSL"
},
"audience": [
{
"@type": "Audience",
"additionalType": "Seniority",
"audienceType": "Architect"
},
{
"@type": "Audience",
"additionalType": "Job function",
"audienceType": "Cybersecurity / Security Architect"
},
{
"@type": "Audience",
"additionalType": "Persona",
"audienceType": "Security Architect"
},
{
"@type": "Audience",
"additionalType": "Buyer role",
"audienceType": "Architect / Technical Evaluator"
},
{
"@type": "Audience",
"additionalType": "Adoption curve",
"audienceType": "Early Majority"
},
{
"@type": "Audience",
"additionalType": "Technology maturity",
"audienceType": "Established Technology"
},
{
"@type": "Audience",
"additionalType": "Industry",
"audienceType": "Information Technology / Cybersecurity / Identity Security / Machine Identity \u0026 Certificate Lifecycle Management"
}
],
"author": {
"@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
"@type": "Person",
"name": "Decision Insights Threat Desk",
"url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
},
"dateModified": "2026-10-13T13:43:24-06:00",
"datePublished": "2026-10-13T13:43:19-06:00",
"description": "CERT/CC reports that TLS libraries, including Go, OpenSSL, Apple, LibreSSL, pyca/cryptography and wolfSSL, interpret X.509 Name Constraints inconsistently.",
"headline": "CERT/CC reports inconsistent X.509 Name Constraints handling across TLS libraries",
"isBasedOn": {
"@type": "CreativeWork",
"author": {
"@type": "Person",
"name": "Timur Snoke"
},
"sourceOrganization": {
"@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
"@type": "Organization",
"mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
"name": "Department of Homeland Security"
},
"url": "https://kb.cert.org/vuls/id/573195"
},
"mainEntityOfPage": {
"@id": "https://decisioninsights.ai/certcc-reports-inconsistent-x.509-name-constraints-handling-across-tls-libraries/",
"@type": "WebPage",
"sdDatePublished": "2026-10-13",
"sdPublisher": {
"@id": "https://decisioninsights.ai/#organization"
}
},
"mentions": [
{
"@id": "https://decisioninsights.ai/registry/openssl/#organization",
"@type": "Organization",
"mainEntityOfPage": "https://decisioninsights.ai/registry/openssl/",
"name": "OpenSSL"
},
{
"@id": "https://decisioninsights.ai/registry/sans-institute/#organization",
"@type": "Organization",
"mainEntityOfPage": "https://decisioninsights.ai/registry/sans-institute/",
"name": "SANS Institute"
},
{
"@id": "https://decisioninsights.ai/projects/ietf-tls-protocol/#project",
"@type": "SoftwareSourceCode",
"mainEntityOfPage": "https://decisioninsights.ai/projects/ietf-tls-protocol/",
"name": "IETF TLS Protocol"
},
{
"@type": "SoftwareSourceCode",
"name": "LibreSSL"
},
{
"@id": "https://decisioninsights.ai/projects/matrix/#project",
"@type": "SoftwareSourceCode",
"mainEntityOfPage": "https://decisioninsights.ai/projects/matrix/",
"name": "Matrix"
},
{
"@id": "https://decisioninsights.ai/projects/openssl/#project",
"@type": "SoftwareSourceCode",
"mainEntityOfPage": "https://decisioninsights.ai/projects/openssl/",
"name": "OpenSSL"
}
],
"publisher": {
"@id": "https://decisioninsights.ai/#organization"
}
}
{
"@context": "https://schema.org",
"@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
"@type": "Person",
"description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards \u0026 Methodology.",
"name": "Decision Insights Threat Desk",
"sameAs": [
"https://www.linkedin.com/showcase/decisioninsights/"
],
"url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
}
Audience targeting
A company states its own audience in marketing copy, if at all. This is Decision Insights' own classification of the content -- seniority, job function, buyer role, adoption curve, technology maturity and target industry -- not the publisher's self-reported audience.
Subject determination
A syndication feed carries a story and every company it happens to name, with no way to tell which one the story is actually about. This is Decision Insights' own determination of this article's subject -- one company, resolved from the source feed's own assignment where one exists, our own analysis otherwise.
Entity resolution
A wire feed names a company as a bare string, mentioned once and never resolved to anything. This is every company and project Decision Insights identified in this article, each linked to its own record with a real address, not a name an agent has to match itself.
Primary source
Our own summary carries our own byline, same as anyone else's would. This is the original work it is based on -- the source URL, its author and its publisher -- so the claim can be checked against where it actually came from, not just taken on our word.