Complete and correct support for directoryName constraints
@sfackler is already working on this.
Since May 10, 2026.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- rust
- Domain
- cryptography, security
Research direction
Start by reproducing the failure with rustls's tlsclient-mio command and inspect the directoryName constraint handling in the certificate-validation code. Compare the issuer constraint with the certificate subject's name attributes, using the crt.sh certificate as a case study; done means the reported certificate validates correctly without regressing other directoryName checks.
Written by the indexing model from the issue text.
Description
Just to record: this and the parent repo do not correctly process directoryName name constraints. The easier reproducer for this is (in rustls):
$ ./target/debug/tlsclient-mio --http www.indicepa.gov.it
TLS error: InvalidCertificateData("invalid peer certificate: UnknownIssuer")
The issuer here is https://crt.sh/?id=5715019745&opt=cablint,x509lint,zlint and we're incorrectly processing the constraint against the end-certificate subject. There seems to be a lack of code that dissects the subject into name attributes, and no code at all for comparing sets of DN attributes for equality?
golang has the same issue https://github.com/golang/go/issues/55872
- Dominant language
- Rust
- Stars
- 167
- Forks
- 112
- Avg merge
- 4h 28m
- Merged PRs (30d)
- 4
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rustls/webpki
-
Difficulty 4/5 3-5 days Newbie friendliness 22/100
-
Path building re-parses every intermediate on each budgeted call (unbudgeted CPU cost)Possibly taken @batmnnn claimed this 23 days ago. Open
Difficulty 3/5 1-2 days Newbie friendliness 72/100
-
Improve error message when denying subject name due to wildcard in public suffixMay be free again @ctz claimed this 79 days ago, and no pull request is open. Open
-
Consider all candidate CRLsMay be free again @cpu claimed this 85 days ago, and no pull request is open. Open
-
Add opt-in support for ignoring URI name constraintsPossibly taken @djc claimed this 135 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Eyevinn/open-live-ingest#36 · 1 comment ·
Maintainers usually reply within 1 day
-
app
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
bug bug jury peripheral:i2s
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
esp-rs/esp-hal#6828 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
ライブラリを追加Openpriority middle
Difficulty 1/5 Under an hour Newbie friendliness 62/100
KATO-Hiro/AtCoderClans#13015 ·
Maintainers usually reply within 1 day