tree b6dc461bec7a852a6b9c2490446c1a8229e3941b
parent 923feba60897676019b00d017ae4eba796a1f6ff
author David Benjamin <davidben@google.com> 1555540732 -0500
committer Adam Langley <agl@google.com> 1555612656 +0000

Disable the common name fallback on *any* SAN list.

This aligns with the Go crypto/x509 behavior and reduces the cases when
the SAN to CN fallback occurs. If the certificate is new enough to have
a SAN list, even if it only contains email or IP addresses, it is
reasonable to assume the certificate is new enough that the common name
is not a DNS name.

Update-Note: Our certificate verification is getting slightly stricter.
Change-Id: I9e3466d8dd8a722405c546181a589f797efa43f9
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/35647
Reviewed-by: Adam Langley <agl@google.com>