search

chromium / badssl.com

:lock: Memorable site for testing clients against bad SSL configs.
https://badssl.com
Apache License 2.0
2.84k stars 191 forks source link

IDNA matching for wildcards in SAN #52

Open tiran opened 9 years ago

tiran commented 9 years ago

Here is another test case for your awesome project. A partial wildcard in subjectAltName must not match an IDNA label. For example "x*.example.org" must not match "xn--tst-bma.example.org" (IDNA for tést.example.org).

I fixed the bug in Python and Mozilla last year: http://bugs.python.org/issue17997 https://www.mozilla.org/en-US/security/advisories/mfsa2014-45/

lgarron commented 9 years ago

If I recall correctly, browsers don't even accept x*.example.org. Is it even possible to get a cert like that signed by a public CA?

Either way, I'd be happy to accept a PR adding it to cert-generator.sh for a local testing.