raising "DNSName is not a FQDN" error on names with dashes at end of a part

amazon-archives / certlint

X.509 certificate linter

Apache License 2.0

157 stars 42 forks source link

raising "DNSName is not a FQDN" error on names with dashes at end of a part #12

Closed jmhodges closed 8 years ago

jmhodges commented 8 years ago

Seeing some certlint errors occuring, it seems, because of dashes at the end of a part of a DNS name.

Like this one: https://crt.sh/?id=12297536&opt=cablint with the domain "ssl-.lenaundniklas.de" in it.

That dash at the end of "ssl-" seems to be the problem. Perhaps the Go url parser is too lax for allowing this, or maybe there's a weirdness in what's allowed in a SAN or CN or maybe there's a bug in certlint?

jmhodges commented 8 years ago

It's a bug in the generating code! RFC 952: "The last character must not be a minus sign or period."

pzb commented 8 years ago

According to 952 and 1123 each label (part between periods) must follow that rule. So ssl-. is invalid.

I don't see a bug in certlint here.