4 ms·
Ironically, the article referenced by the author does not blame the C language for this problem. Instead, it blames the CA for issuing the certificates in the f
by psyklic 17y ago
Ironically, the article referenced by the author does not blame the C language for this problem. Instead, it blames the CA for issuing the certificates in the first place:
"Marlinspike said since there is no legitimate reason for a null character to be in a domain name, it’s a mystery why Certificate Authorities accept them in a name."
- olefoo 17y agoYes, and there's no reason for browsers to accept more than one domain name in a CN field. However a quick look through rfc3280 and an ASN.1 reference make me think it is a less than trivial task to figure out what would and would not be a legal termination for a string encoded in the Subject field of a certificate. But it is perfectly reasonable to expect the CA to check for that.