Spec noncompliance: Assumes explicit tagging of NameConstraints members

The ASN.1 definition of NameConstraints is found in the implicitly tagged section of RFC 5820 here:

NameConstraints ::= SEQUENCE {
     permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
     excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }

GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree

GeneralSubtree ::= SEQUENCE {
     base                    GeneralName,
     minimum         [0]     BaseDistance DEFAULT 0,
     maximum         [1]     BaseDistance OPTIONAL }

At the start of the section, there is this definition, setting the default tag type to implicit:

DEFINITIONS IMPLICIT TAGS ::=

Most importantly, permitted and excluded subtrees are implicitly tagged.

However, parsing code in webpki is like this:

https://github.com/briansmith/webpki/blob/049c5ad5c5b0272baf007ef1301acaf9d5c4ac56/src/name.rs#L180-L181

which basically assumes that the values are constructed. This is wrong!

Both openssl and bouncycastle generate certificates that have implicit tags at that position. Example bouncycastle generated cert:

Example openssl generated cert can be found in #134.

Both openssl and bouncycastle generate certificates that have implicit tags at that position. Example bouncycastle generated cert:

Does Firefox accept the implicitly-tagged syntax?
Does Chrome accept the implicitly-tagged syntax?

Rather than have a test case based on what OpenSSL and BouncyCastle generate, it would be better to see an example for a real-world certificate from a publicly-trusted CA. That would give us a better idea of whether the webpki code is buggy. Or even better, we can use Chromium and/or Firefox test data to see what we need to change.

If there is a problem, I'd guess it is in this code:

        let subtrees = der::nested(inner, subtrees_tag, Error::BadDER, |tagged| {
            der::expect_tag_and_get_value(tagged, der::Tag::Sequence)
        })?;

Perhaps it should be instead just:

        let subtrees = der::expect_tag_and_get_value(inner, subtrees_tag)?;

even better, we can use Chromium and/or Firefox test data to see what we need to change.

I've skimmed Firefox test code for example certificates, apparently they use the NIST test suite: https://csrc.nist.gov/projects/pki-testing

I've extracted one of the CA certificates of that test suite here (name is nameConstraintsURI1CACert.crt):

MIIDtzCCAp+gAwIBAgIBSDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJVUzEfMB0GA1UEChMW
VGVzdCBDZXJ0aWZpY2F0ZXMgMjAxMTEVMBMGA1UEAxMMVHJ1c3QgQW5jaG9yMB4XDTEwMDEwMTA4
MzAwMFoXDTMwMTIzMTA4MzAwMFowUDELMAkGA1UEBhMCVVMxHzAdBgNVBAoTFlRlc3QgQ2VydGlm
aWNhdGVzIDIwMTExIDAeBgNVBAMTF25hbWVDb25zdHJhaW50cyBVUkkxIENBMIIBIjANBgkqhkiG
9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp+cs3as6ObnbAg5IEkmXsD/XLGICGl6qVcEKB6eMA0ILAsGd
MHRqybgY25GUQ+o6RfvTHdD40N6Cqjk5vu9+7aAVjrJ0pdUyqHmK6u6TVcRt+xjonlEpo8bpkqqg
V4i7m51qfLP6+KEh2SKUDBwOZ8/jlYIZeKzVXqk2GZx8+VmWWncDz/D7v262km2IiYoZM+1VAUix
Ghoi6ImPeDBE1u7qoxvvBEDKJJ4sj/5+i4yAgr+JNIULvr8DaT17SkwRZquWT18yu2qP2KycneKy
sWm30A6AmAALhFBNX1ljDeLT5U1wBCSTDRP5U4zH+XvAUUEeMyDYMc92a0hjYwE4swIDAQABo4Gm
MIGjMB8GA1UdIwQYMBaAFOR9X9FclYYILAWuvnW2ZafZXahmMB0GA1UdDgQWBBT6KK1BFt4qaBfI
DxwjPyYD3gIUAjAOBgNVHQ8BAf8EBAMCAQYwFwYDVR0gBBAwDjAMBgpghkgBZQMCATABMA8GA1Ud
EwEB/wQFMAMBAf8wJwYDVR0eAQH/BB0wG6AZMBeGFS50ZXN0Y2VydGlmaWNhdGVzLmdvdjANBgkq
hkiG9w0BAQsFAAOCAQEAW+m6tH95z9aBJUxdo/dsjRTdVgxPLGVODxeqpW8IvEEjoYBWgHT5M+g4
WYnzeSjiPvrq1NerYU0DOI2/hb7aoBBq+7MJ2q6BK06ddUTawRhLh4Rfnc36epefkZLKtQuFBKA7
xaqWLlRQa/jMoZ27hKI5b1qraKR+iP1rKPd1epIL4nwqQgAd6z1bJrV8c2V8py7TWE7/b6wuZVR4
aKtFMp2fIN0eo8U1K35YVtmuVw3TJsTlFn/DuZ4R4Tl6GqkdUUvlKXNuY/nMobgfruTG6nvmaLyy
FHtDoamjegjbIx/N1dibXZLf5n32iBXyHHDk7L3ubrarUrutmaHgEEiFZg==

Screenshot_20210113_131431

Sadly I couldn't find any end entity certificate which contains a domain name as the subject alt name. But if you check the cert, you'll see that it's implicitly tagged.

For comparison I made rcgen emit certs both with explicit and implicit tagging. Explicit:

Screenshot_20210113_131347

Implicit (as it should be):

Screenshot_20210113_131320

Rather than have a test case based on what OpenSSL and BouncyCastle generate, it would be better to see an example for a real-world certificate from a publicly-trusted CA.

So I've run a tool to monitor CT transparency logs for occurences of the NameConstraints extension... After going through 5 million certificates it found only one... this extension is rare. This is the certificate:

Its crt.sh URL: https://crt.sh/?id=8937677

It uses test in various places, so not sure if it's real-world or not as to your demands, but it is a publicly trusted cert that made it into various CT logs.

And it uses implicit tagging:

Screenshot_20210213_215215

I've ran another scan over the argon 2021 CT log, scanning 9.5 million certificates as they came in, roughly over a span of 1 day. I've found two more occurrences of the western digital certificate mentioned above. Apparently that certificate is used to sign end entity certificates. I presume it's real world and production because it seems to point to NAS instances of home users.

I have changed the code to emit full chains, so that the end entity cert is shown.

``` -----BEGIN CERTIFICATE----- MIIF+DCCBOCgAwIBAgIRAMvVGuBbnOAlzRAAuGEIAv0wDQYJKoZIhvcNAQELBQAw gZExCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEPMA0GA1UEBxMGSXJ2aW5lMSUw IwYDVQQKExxXZXN0ZXJuIERpZ2l0YWwgVGVjaG5vbG9naWVzMT0wOwYDVQQDEzRX ZXN0ZXJuIERpZ2l0YWwgVGVjaG5vbG9naWVzIENlcnRpZmljYXRpb24gQXV0aG9y aXR5MB4XDTE5MDMxOTAwMDAwMFoXDTIxMDMxODIzNTk1OVowgaoxITAfBgNVBAsT GERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEuMCwGA1UECxMlSG9zdGVkIGJ5IFdl c3Rlcm4gRGlnaXRhbCBDb3Jwb3JhdGlvbjEqMCgGA1UECxMhQ09NT0RPIFNTTCBV bmlmaWVkIENvbW11bmljYXRpb25zMSkwJwYDVQQDEyBkZXZpY2UzNjk0NzUyLWM2 N2RjM2Y0LndkMmdvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB ALL1dSibJ70ctZFlP7tN+URvCmWuVLUWAv4pi5lmu0KQZ57srACcytFJGRucsRnz uCvviZsu8J25Q9oleuWyN9I1A2t2kzWkyLhXpfbfvJHcUHMiqoua9tOrqx8yE0+g 5F1pyhEHbytjR4HO+0GpPqRFEILroccnXcMhKUf/ZZqJP5ork04rjEqQlMaE4J0g YAoGYdk6vFlIcsHZIPg/PE/3g//xmpIUihdy18QEdfDjY4uDVQNLWgTLlITRlXcC XmOdRIW5JOTqrC5Ov1WL49BPtmlMtA3D0vm5vVLjlaS/X3R7wvv/ab9dqgtXhHfe 6bZg1VEhcQub9Jd5Pc7ClS0CAwEAAaOCAi4wggIqMB8GA1UdIwQYMBaAFFkQGp33 2Dc0/a3VC6xorgL3oL2DMB0GA1UdDgQWBBQk04bnvDDzlElXmnS7LcxDIyGUyTAO BgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcD AQYIKwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICMzArMCkGCCsGAQUF BwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwXQYD VR0fBFYwVDBSoFCgToZMaHR0cDovL2NybC5jb21vZG9jYS5jb20vV2VzdGVybkRp Z2l0YWxUZWNobm9sb2dpZXNDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDCBkAYI KwYBBQUHAQEEgYMwgYAwWAYIKwYBBQUHMAKGTGh0dHA6Ly9jcnQuY29tb2RvY2Eu Y29tL1dlc3Rlcm5EaWdpdGFsVGVjaG5vbG9naWVzQ2VydGlmaWNhdGlvbkF1dGhv cml0eS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTAT BgorBgEEAdZ5AgQDAQH/BAIFADBTBgNVHREETDBKgiBkZXZpY2UzNjk0NzUyLWM2 N2RjM2Y0LndkMmdvLmNvbYImZGV2aWNlMzY5NDc1Mi1jNjdkYzNmNC1sb2NhbC53 ZDJnby5jb20wDQYJKoZIhvcNAQELBQADggEBAFI93Jv+JbamVcc/KlBlbEUkgkRL UrlyBdjWL5Omh0izEZtMLi3M40bLLaVG8Dx9dbjWMqPzI8rw6zHG1pou8iHF73HZ S10NltDCaAsF1q2QkHtydeLhunOWhz56FukeW3qqL60n/paL6C0DNkN7rpBpS6KM ExzLyi6VH0klpDiyl8tnRrVJ0Ofz/YKfQg3qeFC/FpBff9shNv4Aaq0cWpNDvomS CI2y/ZvdiIkL06Z4286INT9DJvGNUVv4zhz1fkLc6Hbp9Z5uKgl+ZCOoasbitVBK U+y3jfeN3AG55tuMhhcvfRi9L1IKE73G/WhCCf3PX2Lmw2mUiUCYlaRls7w= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIG/DCCBOSgAwIBAgIQTdy8TYuqAGsfMhsAiU9C7jANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUwNDI5 MDAwMDAwWhcNMjUwNDI4MjM1OTU5WjCBkTELMAkGA1UEBhMCVVMxCzAJBgNVBAgT AkNBMQ8wDQYDVQQHEwZJcnZpbmUxJTAjBgNVBAoTHFdlc3Rlcm4gRGlnaXRhbCBU ZWNobm9sb2dpZXMxPTA7BgNVBAMTNFdlc3Rlcm4gRGlnaXRhbCBUZWNobm9sb2dp ZXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQCJBlUwAHMI7whlu0dUeOHpnWajTXdOKt8vBo+tjSyD/SyXxhr9 G61pCO2xb7hwOtVqVXcvByBrxpyJtNe0/6kTIg2DM4uFJ1NyHmny7vh6hrjHMhY+ gE/qdy4vTetTY9Swqr/zthJBooZH8tj2wC5vLO++BNKCILcbPy1TlKghXpULROgQ UkBY3FksDd/DF2bLcevUkZY4a8MLHY+6KWpES3vApJ98rWtWMuMRiS0JipXXrIcI qTOjBuGdJNRU0T279AsheA8UBurGg4H+iDiB2q+WFmNQiJ60a7J6Bg9SiLqXm2cc J2+g1QfZIyiv07+yLWWKrxEmd4r9NSiJHcUvAgMBAAGjggJYMIICVDAfBgNVHSME GDAWgBS7r34CPfqm8TyEjq3uOJjs2TIy1DAdBgNVHQ4EFgQUWRAanffYNzT9rdUL rGiuAvegvYMwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy MQECAjMwCAYGZ4EMAQIBMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly9jcmwuY29t b2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHEG CCsGAQUFBwEBBGUwYzA7BggrBgEFBQcwAoYvaHR0cDovL2NydC5jb21vZG9jYS5j b20vQ09NT0RPUlNBQWRkVHJ1c3RDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9v Y3NwLmNvbW9kb2NhLmNvbTCB6QYDVR0eBIHhMIHeoIGpMA+CDXJlbW90ZXdkMS5j b20wD4INcmVtb3Rld2QyLmNvbTAPgg1yZW1vdGV3ZDMuY29tMA+CDXJlbW90ZXdk NC5jb20wD4INcmVtb3Rld2Q1LmNvbTALggl3ZDJnby5jb20wDYILd2R0ZXN0MS5j b20wDYILd2R0ZXN0Mi5jb20wJ6QlMCMxITAfBgNVBAsTGERvbWFpbiBDb250cm9s IFZhbGlkYXRlZKEwMAqHCAAAAAAAAAAAMCKHIAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAMA0GCSqGSIb3DQEBDAUAA4ICAQBcKmEBtmSC6qx86SdD2aLd h4s72ME1D/1YrvpDOSE9hJ8w449Fm0kAtTJYRyoQ1XYoChVy3G5W1KtC87u3MbAh 98BZ3A9ECxfcW/Fh83ziuaaztKNorBI5jSHAKKxHQD6GpsnKNiqJCn4tEI6LPHRD qcxnmMolytp1UrGYIyiDhZwPjYxVBHHPuFi0RxewKn6QSI6Z91IAvrmdgpJyruUX 7GHZmEdxnL4CeQr3m7EG7cMr5PqppLmtWzKfzKnIYxX3dF8/yPCleP5/R6SsJmHh LZboPlmOz8M8YjxFp590dwS6+CL34ngrow5rT6FCYM32T7gL6n0BnzOsyKjAhLRf KkLxo3P4uSlJ4eDLy7dbTpTvJyo1qyVX512aaJpaFnTfQTawX+vqK9UlcIqwhmCx lqqRaVw64a7i5nSMOIqSN7RL1PlKwuJx7GR0ajwOs1a6gHLKiC9fpefTLb7XLqWi 5tNY4BkED21dUwEVwmf8b+oQw8Brn56CSVd1QEhu7knwEfB3O1rErNPiqgEg5JR/ 6gGjlj+0vGGLXtWrA8Fp72+bchAed3qjQpQmhEVLAqxdRCoxBp14gr7lSGaUcQbx XJLJ8GrVoyQGfdgtxyy0JT3gHgBF7qRiox+zqqNS72JQelBK1gIr6UmCNQTbp+eO oBE7elaoresGFzV1PkCBSA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5 MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR 6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC 9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV /erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z +pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB /wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM 4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV 2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl 0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB NVOFBkpdn627G190 -----END CERTIFICATE----- ```

``` -----BEGIN CERTIFICATE----- MIIHZTCCBk2gAwIBAgIRAIcbJreb3CjirR5QCuhYQ3kwDQYJKoZIhvcNAQELBQAw gZExCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEPMA0GA1UEBxMGSXJ2aW5lMSUw IwYDVQQKExxXZXN0ZXJuIERpZ2l0YWwgVGVjaG5vbG9naWVzMT0wOwYDVQQDEzRX ZXN0ZXJuIERpZ2l0YWwgVGVjaG5vbG9naWVzIENlcnRpZmljYXRpb24gQXV0aG9y aXR5MB4XDTE5MDMwODAwMDAwMFoXDTIxMDMwNzIzNTk1OVowgaoxITAfBgNVBAsT GERvbWFpbiBDb250cm9sIFZhbGlkYXRlZDEuMCwGA1UECxMlSG9zdGVkIGJ5IFdl c3Rlcm4gRGlnaXRhbCBDb3Jwb3JhdGlvbjEqMCgGA1UECxMhQ09NT0RPIFNTTCBV bmlmaWVkIENvbW11bmljYXRpb25zMSkwJwYDVQQDEyBkZXZpY2U2NjQxMzQwLWQ3 M2UwMzJhLndkMmdvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AJIZ+fcr4mG7pDB/Vp+M6v0o3GHTP4kRRHovhGttU1w4PukB+oo0o0X0CGEZ1+Q+ riFw0atN0G8vsAgmt2fBEZLHARBffoESb0azXxq4JkPKVd9e6e4ru4cD35rWqlfl s0uKLOLkOC1dXwGUuOHKi+TKTbUOUTLIOhSYgFCrshWL5YFwU5NXkJXCD+FyaP2k L/K9ICrmuxt8c9iMzCKoW53lrD37yBIj0M5izJjmHW1EPlXiqxg9PZa6x3fOFSPv NGunoMdWtjy0wiCm3v/B3bluBroaSb3hsIkXmDYW35qb6Iix7KRB5sn7IRqlOmgx Z2qsBQTTuldUVlE7jRCPbd0CAwEAAaOCA5swggOXMB8GA1UdIwQYMBaAFFkQGp33 2Dc0/a3VC6xorgL3oL2DMB0GA1UdDgQWBBQt5gt2NHV9wivqb0DopNgWkaUGXzAO BgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAdBgNVHSUEFjAUBggrBgEFBQcD AQYIKwYBBQUHAwIwTwYDVR0gBEgwRjA6BgsrBgEEAbIxAQICMzArMCkGCCsGAQUF BwIBFh1odHRwczovL3NlY3VyZS5jb21vZG8uY29tL0NQUzAIBgZngQwBAgEwXQYD VR0fBFYwVDBSoFCgToZMaHR0cDovL2NybC5jb21vZG9jYS5jb20vV2VzdGVybkRp Z2l0YWxUZWNobm9sb2dpZXNDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDCBkAYI KwYBBQUHAQEEgYMwgYAwWAYIKwYBBQUHMAKGTGh0dHA6Ly9jcnQuY29tb2RvY2Eu Y29tL1dlc3Rlcm5EaWdpdGFsVGVjaG5vbG9naWVzQ2VydGlmaWNhdGlvbkF1dGhv cml0eS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmNvbW9kb2NhLmNvbTBT BgNVHREETDBKgiBkZXZpY2U2NjQxMzQwLWQ3M2UwMzJhLndkMmdvLmNvbYImZGV2 aWNlNjY0MTM0MC1kNzNlMDMyYS1sb2NhbC53ZDJnby5jb20wggF+BgorBgEEAdZ5 AgQCBIIBbgSCAWoBaAB1ALvZ37wfinG1k5Qjl6qSe0c4V5UKq1LoGpCWZDaOHtGF AAABaVxtmlEAAAQDAEYwRAIgGFsgdQEpddPtZGqbsi+Z5DWM7jcs3aIFnGIziyVd aVgCIFR0pUB178fTLtQMXmQ0RJUAmGdYhuJEGKLIhmR6+bRMAHcARJRlLrDuzq/E QAfYqP4owNrmgr7YyzG1P9MzlrW2gagAAAFpXG2amAAABAMASDBGAiEAu0F04xpB ni7B9gX9VVhoZOEWSLPCBSHXT3GJWpooO8YCIQDC5yi0ihO08wob2uVybpiONk2j ZPzGmxxRrui4h6707wB2AFzcQ5L+5qtFRLFemtRW5hA3+9X6R9yhc5SyXub2xw7K AAABaVxtmvUAAAQDAEcwRQIhALllPcZgXx5WhTTOTqEZuR9amfB4NglP/pv8BMVq naajAiAURtZMdPfUp/yE49eZqnCvxmdUMdtaxlZmEhwxtPJWoTANBgkqhkiG9w0B AQsFAAOCAQEAPHcMEEuNF5mLLfh+VUgSikxyBhOTSU80i46ta+YlnGNqg78pQZR8 GQORYuJ2IOCy14/d7LUcFoGGczK0c8pAqHLMXvlVlXR4BRetCPV4btKn5chwWtRD UnPS8qejByxlswxSrHTUqeLoccbmknYOp+o1LQqmxjBJ8mcLCsHDmadUmk7/cqZx StafzFY9U52q9kWF1r3ROuXk46F6yiiGyfYX2/vVArqBPm7fqW6+C1LYCD/TAzl+ HfDrVMZRTK1RYOURzLK7Y1QHAxJhnb20onKpwh8U+e1uk4LMIFWACRYy7MLuvfyU MM5Lumm2J9e4Is8FKqITOm66GXllrTzKzg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIG/DCCBOSgAwIBAgIQTdy8TYuqAGsfMhsAiU9C7jANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTUwNDI5 MDAwMDAwWhcNMjUwNDI4MjM1OTU5WjCBkTELMAkGA1UEBhMCVVMxCzAJBgNVBAgT AkNBMQ8wDQYDVQQHEwZJcnZpbmUxJTAjBgNVBAoTHFdlc3Rlcm4gRGlnaXRhbCBU ZWNobm9sb2dpZXMxPTA7BgNVBAMTNFdlc3Rlcm4gRGlnaXRhbCBUZWNobm9sb2dp ZXMgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQCJBlUwAHMI7whlu0dUeOHpnWajTXdOKt8vBo+tjSyD/SyXxhr9 G61pCO2xb7hwOtVqVXcvByBrxpyJtNe0/6kTIg2DM4uFJ1NyHmny7vh6hrjHMhY+ gE/qdy4vTetTY9Swqr/zthJBooZH8tj2wC5vLO++BNKCILcbPy1TlKghXpULROgQ UkBY3FksDd/DF2bLcevUkZY4a8MLHY+6KWpES3vApJ98rWtWMuMRiS0JipXXrIcI qTOjBuGdJNRU0T279AsheA8UBurGg4H+iDiB2q+WFmNQiJ60a7J6Bg9SiLqXm2cc J2+g1QfZIyiv07+yLWWKrxEmd4r9NSiJHcUvAgMBAAGjggJYMIICVDAfBgNVHSME GDAWgBS7r34CPfqm8TyEjq3uOJjs2TIy1DAdBgNVHQ4EFgQUWRAanffYNzT9rdUL rGiuAvegvYMwDgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYD VR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMCIGA1UdIAQbMBkwDQYLKwYBBAGy MQECAjMwCAYGZ4EMAQIBMEwGA1UdHwRFMEMwQaA/oD2GO2h0dHA6Ly9jcmwuY29t b2RvY2EuY29tL0NPTU9ET1JTQUNlcnRpZmljYXRpb25BdXRob3JpdHkuY3JsMHEG CCsGAQUFBwEBBGUwYzA7BggrBgEFBQcwAoYvaHR0cDovL2NydC5jb21vZG9jYS5j b20vQ09NT0RPUlNBQWRkVHJ1c3RDQS5jcnQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9v Y3NwLmNvbW9kb2NhLmNvbTCB6QYDVR0eBIHhMIHeoIGpMA+CDXJlbW90ZXdkMS5j b20wD4INcmVtb3Rld2QyLmNvbTAPgg1yZW1vdGV3ZDMuY29tMA+CDXJlbW90ZXdk NC5jb20wD4INcmVtb3Rld2Q1LmNvbTALggl3ZDJnby5jb20wDYILd2R0ZXN0MS5j b20wDYILd2R0ZXN0Mi5jb20wJ6QlMCMxITAfBgNVBAsTGERvbWFpbiBDb250cm9s IFZhbGlkYXRlZKEwMAqHCAAAAAAAAAAAMCKHIAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAMA0GCSqGSIb3DQEBDAUAA4ICAQBcKmEBtmSC6qx86SdD2aLd h4s72ME1D/1YrvpDOSE9hJ8w449Fm0kAtTJYRyoQ1XYoChVy3G5W1KtC87u3MbAh 98BZ3A9ECxfcW/Fh83ziuaaztKNorBI5jSHAKKxHQD6GpsnKNiqJCn4tEI6LPHRD qcxnmMolytp1UrGYIyiDhZwPjYxVBHHPuFi0RxewKn6QSI6Z91IAvrmdgpJyruUX 7GHZmEdxnL4CeQr3m7EG7cMr5PqppLmtWzKfzKnIYxX3dF8/yPCleP5/R6SsJmHh LZboPlmOz8M8YjxFp590dwS6+CL34ngrow5rT6FCYM32T7gL6n0BnzOsyKjAhLRf KkLxo3P4uSlJ4eDLy7dbTpTvJyo1qyVX512aaJpaFnTfQTawX+vqK9UlcIqwhmCx lqqRaVw64a7i5nSMOIqSN7RL1PlKwuJx7GR0ajwOs1a6gHLKiC9fpefTLb7XLqWi 5tNY4BkED21dUwEVwmf8b+oQw8Brn56CSVd1QEhu7knwEfB3O1rErNPiqgEg5JR/ 6gGjlj+0vGGLXtWrA8Fp72+bchAed3qjQpQmhEVLAqxdRCoxBp14gr7lSGaUcQbx XJLJ8GrVoyQGfdgtxyy0JT3gHgBF7qRiox+zqqNS72JQelBK1gIr6UmCNQTbp+eO oBE7elaoresGFzV1PkCBSA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5 MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR 6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC 9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV /erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z +pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB /wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM 4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV 2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl 0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB NVOFBkpdn627G190 -----END CERTIFICATE----- ```

Found some more uses of the NameConstraints extension. Both use implicit tagging:

https://crt.sh/?id=12729421 "Intel External Issuing CA 7B"
https://crt.sh/?id=12728830 "Intel External Issuing CA 7A"

So far it's only implicit tags, except for webpki's expectations :).

Yes, I'm convinced webpki needs to be fixed. What I really need is a test case that includes the end-entity certificate, the intermediates, and the root.

@briansmith you can find full chains in the comment above.

briansmith / webpki

Spec noncompliance: Assumes explicit tagging of NameConstraints members #135