Ryan Sleevi Reporter
	Description • 11 years ago

This is a variation of Bug 394919, and only exists because Bug 552346 has not yet been implemented.

In CERT_VerifyCertName, when no subjectAltName is present, if the hostname-to-be-validated is an IP address, a strict string comparison is made of the common name (see http://mxr.mozilla.org/nss/source/lib/certdb/certdb.c#1787 )

As a result of Bug 394919, the Common Name is checked that it is valid according to the permittedSubtrees for dNSNames. However, if the CN is to be treated as an iPAddress (in CERT_VerifyCertName), no checking of the permittedSubtrees for iPAddress is done.

This is because CERT_GetConstrainedCertificateNames always treats the CN as a dNSName, even when the hostname-to-be-verified contains an IP/will be treated as an IP (see http://mxr.mozilla.org/nss/source/lib/certdb/genname.c#1106 )

	Kai Engert (:KaiE:)
	Comment 1 • 11 years ago

changing target milestone to 3.15.4