Add CABF CN/SAN compliance test cases#533
Merged
Conversation
which mandates that commonName must exactly match a SAN entry when present. Tests cover: - IPv4 format mismatches (hex, leading zeros) - IPv6 format variations (uppercase, uncompressed, non-RFC 5952) - IDN encoding mismatches (punycode vs UTF-8) - General CN/SAN mismatches and case sensitivity 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
Contributor
Author
|
Since the bot cannot run when the PR comes from a fork, here is a copy from our fork for informational purposes: New testcasesThere are new testcases in this change. openssl-3.5.4
pyca-cryptography-46.0.3
rust-webpki
openssl-3.6.0
gnutls-certtool-3.8.3
certvalidator-0.11.1
gocryptox509-go1.25.4
openssl-3.2.6
openssl-3.0.18
openssl-3.4.3
rustls-webpki
openssl-3.3.5
openssl-1.1
|
woodruffw
reviewed
Jan 2, 2026
limbo/testcases/webpki/cn.py
Outdated
|
|
||
|
|
||
| @testcase | ||
| def cabf_cn_ipv4_hex_mismatch(builder: Builder) -> None: |
Collaborator
There was a problem hiding this comment.
nit: could we remove the cabf_cn_ prefix from these tests? The harness should auto-prefix these by their namespace, e.g. ipv4_hex_mismatch should become webpki::cn::ipv4-hex-mismatch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds 9 test cases to verify CABF Baseline Requirements Section 7.1.4.3 compliance, which mandates that
commonNamemust exactly match a SAN entry when present.The following scenarios are tested (all should result in rejection):
cabf_cn_ipv4_hex_mismatch: IPv4 hex format CN vs dotted-decimal SANcabf_cn_ipv4_leading_zeros_mismatch: IPv4 with leading zeros vs canonical formcabf_cn_ipv6_uppercase_mismatch: IPv6 uppercase vs lowercasecabf_cn_ipv6_uncompressed_mismatch: IPv6 uncompressed vs RFC 5952 compressedcabf_cn_ipv6_non_rfc5952_mismatch: IPv6 non-RFC 5952 compliant formattingcabf_cn_punycode_vs_utf8_mismatch: Different punycode domainscabf_cn_utf8_vs_punycode_mismatch: UTF-8 CN vs punycode SANcabf_cn_not_in_san: CN not matching any SAN entrycabf_cn_case_mismatch: CN matching SAN with different caseThe docstring for each test case includes a reference to the specific section in the CABF requirements (or one of its references) that is violated when accepting the corresponding cert.
🤖 Generated with Claude Code