tree 46c79afc44ccf3986de03afefaccfe5ca434538f
parent 04a89c843598b07ac5cc4de3eecde998b43451ce
author Adam Langley <alangley@gmail.com> 1568750161 -0700
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1568923006 +0000

Don't allow SGC EKUs for server certificates.

The Server Gated Cryptography EKUs are a left-over from 1990's export
regulations. For historical reaons, the SGC EKUs are accepted as a valid
substitute for a server authentication EKU, but they shouldn't be. This
change makes it so that we ignore them.

Change-Id: Ie184c52f588ae391a95d61c474ee6324bdd8f4f2
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37545
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: David Benjamin <davidben@google.com>