Add opt-in support for ignoring URI name constraints

Open
  • Is something wrong?
#514 2 comments 1 reaction 0 assignees View on GitHub

@djc is already working on this.

Since Jul 2, 2026.

  • #515 by @djc — open

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
rust
Domain
security

Research direction

Start by reviewing the URI name-constraint handling introduced in release 0.103.12 and the verifier API, since no specific files or tests are named. Done means the default rejection remains unchanged while callers have an opt-in path that ignores URI name constraints for their own enforcement.

Written by the indexing model from the issue text.

Description

As of release 0.103.12, which has the fix for GHSA-965h-392x-2mh5, a chain containing a URI name constraint is now rejected unconditionally, where previously the constraint was silently ignored.

This definitely makes sense as a default, but it's a breaking change for anyone whose CAs already carry URI name constraints. Webpki doesn't expose an API to assert URI names in the first place, so callers who care about URI name constraints may have been enforcing them themselves against the verified cert chain. For those callers the unconditional rejection short-circuits path validation before any other enforcement can run, and AFAICT there's no way to keep things working short of pinning a pre-0.103.12 version.

Is there any room for an opt-in (eg a flag on the verifier) that restores the old "ignore URI name constraints" behavior and leaves enforcement to the caller? Happy to submit a PR for this if there's interest.

Dominant language
Rust
Stars
167
Forks
112
Avg merge
4h 28m
Merged PRs (30d)
4

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rustls/webpki

All issues in rustls/webpki

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.