Open Bug 1256073 Opened 9 years ago Updated 3 years ago

disallow matching UTF8String with PrintableString in distinguished name comparisons as per RFC 5280 section 4.2.1.10

Categories

(Core :: Security: PSM, defect, P3)

Product:
Core
Component:
Security: PSM
Type:
defect

Tracking

()

People

(Reporter: keeler, Unassigned)

Details

(Whiteboard: [psm-backlog])

In bug 1150114, we added a compatibility workaround to mozilla::pkix whereby when matching two distinguished names, if one name's string type was UTF8String and the other was PrintableString, they were considered to match if their contents were the same. This is counter to RFC 5280 section 4.2.1.10. The goal is to remove this workaround by requiring certificates subject to the baseline requirements with a validity period beginning after a certain date match string types exactly to be considered equal.
Assignee: nobody → dkeeler
Whiteboard: [psm-assigned]
Assignee: dkeeler → nobody
Priority: -- → P3
Whiteboard: [psm-assigned] → [psm-backlog]
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.