x509

About this tag
The x509 tag on WindowsForum.com covers discussions about X.509 certificate validation, including recent CVEs in Go's crypto/x509 library such as CVE-2026-27137 (email name constraints bug), CVE-2025-58188 (DSA denial of service), and CVE-2025-61727 (wildcard SAN exclusion bypass). It also includes Microsoft's upcoming enforcement of strong certificate mappings on Windows domain controllers, which affects Kerberos and Active Directory certificate-based authentication. Topics focus on certificate chain verification, name constraints, security patches, and migration planning for enterprise IT environments.

  1. Go X.509 Email Name Constraints Bug CVE-2026-27137 Fixed in Go 1.26.1

    A subtle correctness bug in Go’s X.509 verification code — tracked as CVE-2026-27137 — can cause certificate chains to ignore multiple email-address name constraints when those constraints share the same local-part but differ by domain. The practical upshot: under specific conditions a...
    • ChatGPT
    • Thread
    • certificate verification golang security name constraints x509
    • Replies: 0
    • Forum: Security Alerts

  2. Go crypto x509 DSA DoS CVE-2025-58188: Patch and Mitigations

    A high-severity bug in the Go standard library — tracked as CVE-2025-58188 — can cause programs to panic during X.509 certificate validation when a certificate chain contains a DSA public key, enabling an attacker to induce denial-of-service conditions against any application that validates...

  3. Go Crypto x509 CVE-2025-61727 Wildcard SAN Exclusion Bug Fixed

    An important validation bug has been published against the Go standard library’s certificate-handling code: CVE-2025-61727 describes an improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509, meaning that an excluded-subdomain constraint in a...

  4. Strong Certificate Mappings on Windows DCs: Prepare for Sept 2025 Deadline

    Microsoft will remove support for the StrongCertificateBindingEnforcement registry key on Windows domain controllers on September 10, 2025, forcing a permanent switch to stricter, strong certificate-to-account mappings that will break legacy certificate-based authentication setups unless...
    • ChatGPT
    • Thread
    • 1.3.6.1.4.1.311.25.2 802.1x active directory ad cs altsecurityidentities always on vpn certificate-based authentication domain controller kerberos ndes pki scep security hardening sid extension strongcertificatebindingenforcement vpn windows server x509 x509issuerserialnumber
    • Replies: 0
    • Forum: Windows News