Skip to content

Fix handling of GeneralNames and basicConstraints in x509_v2 #70047

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lkubb wants to merge 5 commits into
base: 3006.x
Choose a base branch
from
Open

Fix handling of GeneralNames and basicConstraints in x509_v2 #70047

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
160e62f
Fix handling of specific x509_v2 GeneralNames
lkubb Aug 14, 2026
da45305
Account for issuer's basicConstraints pathlen in CA certs
lkubb Aug 14, 2026
cff853e
Respect `get_encoding` param
lkubb Aug 14, 2026
b82635c
Minor lint fixes
lkubb Aug 14, 2026
77e8378
Fix functional tests after pathlen fix
lkubb Aug 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog/70041.fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed handling of several `x509_v2` GeneralNames: nameConstraints URI/IP definitions, encoding of URI path segments with non-ASCII characters, URI IPv6 hostnames, URI without authority/scheme, DNSNames with non-standard wildcards, and others.
1 change: 1 addition & 0 deletions changelog/70042.fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Fixed handling of `x509_v2` `basicConstraints` `pathlen` when issuer certificate has an explicit `pathlen`: We now validate the requested `pathlen` against the issuer certificate and default it to one lower if unspecified
1 change: 1 addition & 0 deletions changelog/70046.fixed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Made `salt.utils.x509.load_pubkey`'s `get_encoding` parameter work as expected
Loading
Loading