Skip to content

Conversation

t4niwa
Copy link
Contributor

@t4niwa t4niwa commented Oct 15, 2025

Description

In Go 1.25.2, the verification of X.509 certificate SANs (Subject Alternative Names) has been made stricter.

Certificates like the following are now treated as invalid:

  • Domain names with a trailing dot (.): Such as the Fully Qualified Domain Name (FQDN) format example.com.
  • Domain names with empty labels: Such as .example.com or example..com
  • Labels exceeding 63 characters: Long domain names that exceed DNS label limits
  • Improperly formatted email addresses: rfc822Name formats that do not comply with RFC 5322

A unit test was added to maintain backward compatibility.

Type of change

  • Bug fix
  • New feature
  • Refactoring (no functional changes, no api changes)
  • Non-code changes (update documentation, pipeline, etc.)

Flags

  • Breaks backward compatibility
  • Requires a documentation update
  • Has untestable code

Related issue/PR

Delete this section if there are no issues or pull requests that relate to this pull request.

  • Fixes #issue
  • Closes #PR

Checklist

  • Followed the guidelines in the CONTRIBUTING document
  • Added prefix [skip ci]/[ci skip]/[no ci]/[skip actions]/[actions skip] in the PR title if necessary
  • Tested and linted the code
  • Commented the code
  • Made corresponding changes to the documentation
  • Passed all pipeline checking

Checklist for maintainer

  • Use Squash and merge
  • Double-confirm the merge message has prefix [skip ci]/[ci skip]/[no ci]/[skip actions]/[actions skip]
  • Delete the branch after merge

Signed-off-by: taniwa <taniwa@lycorp.co.jp>
@t4niwa t4niwa self-assigned this Oct 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant