Summary
A certificate-validation flaw in Bouncy Castle for C# can incorrectly accept a certificate whose directoryName falls outside the permitted subtree defined by a name-constrained intermediate CA. An attacker who controls such an intermediate CA, or can obtain certificates from it, may bypass intended PKIX name restrictions and have an unauthorized certificate accepted during path validation.
A certificate-validation flaw in Bouncy Castle for C# can incorrectly accept a certificate whose directoryName falls outside the permitted subtree defined by a name-constrained intermediate CA. An attacker who controls such an intermediate CA, or can obtain certificates from it, may bypass intended PKIX name restrictions and have an unauthorized certificate accepted during path validation.
Affected context
The issue occurs in Bouncy Castle C# deployments that perform PKIX certificate path validation with directoryName name constraints and use the affected PkixNameConstraintValidator.WithinDNSubtree logic. It can affect validation of subject distinguished names or directoryName subject alternative names when a constrained intermediate CA is involved and the certificate name contains additional RDNs before a copy of the permitted sequence.
The issue occurs in Bouncy Castle C# deployments that perform PKIX certificate path validation with directoryName name constraints and use the affected PkixNameConstraintValidator.WithinDNSubtree logic. It can affect validation of subject distinguished names or directoryName subject alternative names when a constrained intermediate CA is involved and the certificate name contains additional RDNs before a copy of the permitted sequence.
Exploit preconditions
- Attack surface: Applications or services that validate X.509 certificate chains using Bouncy Castle C#.
- Required access: Control of a name-constrained intermediate CA, or the ability to obtain certificates issued by one.
- Trigger point: PKIX path validation of a certificate containing a subject distinguished name or
directoryNamesubject alternative name. - Why exploitation is possible: The validator may locate the first permitted RDN sequence within a name rather than requiring it to be the name's initial prefix, allowing an out-of-scope name to satisfy the constraint.
- Attack surface: Applications or services that validate X.509 certificate chains using Bouncy Castle C#.
- Required access: Control of a name-constrained intermediate CA, or the ability to obtain certificates issued by one.
- Trigger point: PKIX path validation of a certificate containing a subject distinguished name or
directoryNamesubject alternative name. - Why exploitation is possible: The validator may locate the first permitted RDN sequence within a name rather than requiring it to be the name's initial prefix, allowing an out-of-scope name to satisfy the constraint.
Why this happens
The underlying bug is improper certificate validation in the directoryName name-constraint comparison. Instead of enforcing the RFC 5280 requirement that the permitted relative distinguished name sequence appear as the required initial prefix, the validator searches for the constraint's first RDN elsewhere in the name and compares subsequent RDNs from that position. This insecure comparison can treat a name outside the permitted subtree as valid, mapping to CWE-295: Improper Certificate Validation.
The underlying bug is improper certificate validation in the directoryName name-constraint comparison. Instead of enforcing the RFC 5280 requirement that the permitted relative distinguished name sequence appear as the required initial prefix, the validator searches for the constraint's first RDN elsewhere in the name and compares subsequent RDNs from that position. This insecure comparison can treat a name outside the permitted subtree as valid, mapping to CWE-295: Improper Certificate Validation.
Potential impact
- A certificate outside an intermediate CA's permitted namespace may be accepted.
- Applications may authenticate an unauthorized subject or service.
- TLS, signing, or identity-assurance decisions could be weakened.
- Trust boundaries relying on name constraints may be bypassed.
- Downstream systems could be exposed to impersonation or policy circumvention.
- A certificate outside an intermediate CA's permitted namespace may be accepted.
- Applications may authenticate an unauthorized subject or service.
- TLS, signing, or identity-assurance decisions could be weakened.
- Trust boundaries relying on name constraints may be bypassed.
- Downstream systems could be exposed to impersonation or policy circumvention.
General mitigation guidance
Mitigation generally focuses on using certificate-validation logic that strictly implements RFC 5280 name-constraint semantics and rejects directoryName values that do not begin with the permitted RDN sequence.
Defensive patterns include:
- Use maintained validation components that correctly enforce name constraints.
- Treat certificate names and intermediate CA relationships as untrusted inputs.
- Apply independent policy checks for expected identities, namespaces, and certificate purposes.
- Limit trust in intermediate CAs and issue certificates only within explicitly authorized namespaces.
- Fail closed when name-constraint parsing or comparison is ambiguous.
- Keep certificate-validation dependencies governed by security review and dependency-management policies.
Mitigation generally focuses on using certificate-validation logic that strictly implements RFC 5280 name-constraint semantics and rejects directoryName values that do not begin with the permitted RDN sequence.
Defensive patterns include:
- Use maintained validation components that correctly enforce name constraints.
- Treat certificate names and intermediate CA relationships as untrusted inputs.
- Apply independent policy checks for expected identities, namespaces, and certificate purposes.
- Limit trust in intermediate CAs and issue certificates only within explicitly authorized namespaces.
- Fail closed when name-constraint parsing or comparison is ambiguous.
- Keep certificate-validation dependencies governed by security review and dependency-management policies.
How teams detect issues like this
Detection approaches can include:
- Static analysis and dependency review for certificate-validation libraries and name-constraint implementations.
- Code review checks for substring, search-based, or position-insensitive comparisons of distinguished-name components.
- Unit and integration tests containing valid prefixes, invalid prefixes, reordered RDNs, and names with additional leading RDNs.
- Certificate-path testing that verifies both permitted and excluded directoryName subtrees.
- Runtime monitoring for unexpected certificate subjects, issuers, or namespace relationships.
- Policy enforcement requiring approved validation libraries and negative certificate-validation test coverage.
Detection approaches can include:
- Static analysis and dependency review for certificate-validation libraries and name-constraint implementations.
- Code review checks for substring, search-based, or position-insensitive comparisons of distinguished-name components.
- Unit and integration tests containing valid prefixes, invalid prefixes, reordered RDNs, and names with additional leading RDNs.
- Certificate-path testing that verifies both permitted and excluded directoryName subtrees.
- Runtime monitoring for unexpected certificate subjects, issuers, or namespace relationships.
- Policy enforcement requiring approved validation libraries and negative certificate-validation test coverage.
