News for hackers. Stuff that matters.

A comment on I spent a year of my life making an ASN.1 compiler in D. Parent comment

Re:I spent a year of my life making an ASN.1 compiler in D by cryptonector on Thursday October 23, 2025 @04:08PM (#45686400)
No we're not. We're using dNSName subjectAlternativeName values. We used to use the CN attribute of the subject DN, and... there is still code for that, but it's obsolete.

We _are_ using subject DNs for linking certs to their issuers, but though that's "free-form", we don't parse them, we only check for equality.

[ Parent | on HN ]
Re:I spent a year of my life making an ASN.1 compiler in D by cyberax on Thursday October 23, 2025 @08:33PM (#45689319)
CN is absolutely used everywhere. And it can contain wildcards. SANs are also free-form.
[ Parent | on HN ]
Re:I spent a year of my life making an ASN.1 compiler in D by cryptonector on Thursday October 23, 2025 @11:15PM (#45690375)
SANs are not free-form. A dNSName SAN is supposed to have an FQDN. An rfc822Name SAN is supposed to carry an email address. And, ok, sure, email addresses' mailbox part is basically free-form, but so what, you don't interpret that part unless you've accepted that certificate for that email address' domain part, and then you interpret the mailbox part the way a mail server would because you're probably the mail server. Yes, you can have directoryName SANs, but the whole point of SANs is that DNs suck because x.400/x.500 naming sucks so we want to use something that isn't that.
[ Parent | on HN ]
Re:I spent a year of my life making an ASN.1 compiler in D by cyberax on Thursday October 23, 2025 @11:39PM (#45690512)
> to have an FQDN

With wildcards.

[ Parent | on HN ]
Re:I spent a year of my life making an ASN.1 compiler in D by cryptonector on Friday October 24, 2025 @06:52PM (#45699908)
Ah yes, you're right. That is a horrible bodge.
[ Parent | on HN ]