The use of a null byte in a certificate cn is very well known

and I saw this code in a popular smtp server (who obviously thought it didn’t worth to use the gnutls or openssl for doing that kind of thing) :

static bool
does_name_match(const char * name, const char * pat) {
char * cp;
return *pat == '*'      /* possible wildcard match */
  ?    *++pat == '.'        /* starts star, dot              */
    && !strchr(++pat, '*')  /* has no more stars             */
    && strchr(pat, '.') /* and has another dot.          */
    && (cp = strchr(name, '.'))/* The name has at least one dot */
    && strcmp(++cp, pat) == 0 /* and we only compare after it. */
  :    !strchr(pat+1, '*')
    && strcmp(name, pat) == 0;

which will prevent the recognition of*.\0.thoughtcrime.orgor*.*\0.thoughtcrime.orgwithtip.emailwill trigger a match in the case of*.fmm.email\0.thoughtcrime.orgwithmail.fmm.email

So is it, or was it, possible to register something like*.e10000.biz\0.thoughtcrime.org (since e10000 and biz can be considered as usual words and not only subdomain)

  • I use alsowasbecause I thinkcashould normally reject the registration of null byte in a domain. – user2284570 May 3 '16 at 14:38

Looking at google certificate’s, it’s now very clear…

The answer is yes of course since you can request to be a certificate authority for the domains you control…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.