crypto/x509: excluded subdomain constraint doesn't preclude wildcard SAN (CVE-2025-61727) #76442
Description
A certificate with the excluded constraint foo.example.com should preclude a leaf with the SAN *.example.com. This unfortunately is not well defined in the X.509 specifications, so slipped through.
This is a PUBLIC track security issue.