{"action":"created","issue":{"url":"https://api.github.com/repos/zmap/zlint/issues/175","repository_url":"https://api.github.com/repos/zmap/zlint","labels_url":"https://api.github.com/repos/zmap/zlint/issues/175/labels{/name}","comments_url":"https://api.github.com/repos/zmap/zlint/issues/175/comments","events_url":"https://api.github.com/repos/zmap/zlint/issues/175/events","html_url":"https://github.com/zmap/zlint/issues/175","id":258074871,"number":175,"title":"Misapplication of e_dnsname_bad_character_in_label","user":{"login":"robstradling","id":958624,"avatar_url":"https://avatars2.githubusercontent.com/u/958624?v=4","gravatar_id":"","url":"https://api.github.com/users/robstradling","html_url":"https://github.com/robstradling","followers_url":"https://api.github.com/users/robstradling/followers","following_url":"https://api.github.com/users/robstradling/following{/other_user}","gists_url":"https://api.github.com/users/robstradling/gists{/gist_id}","starred_url":"https://api.github.com/users/robstradling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robstradling/subscriptions","organizations_url":"https://api.github.com/users/robstradling/orgs","repos_url":"https://api.github.com/users/robstradling/repos","events_url":"https://api.github.com/users/robstradling/events{/privacy}","received_events_url":"https://api.github.com/users/robstradling/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-09-15T15:15:08Z","updated_at":"2017-09-15T15:53:12Z","closed_at":null,"author_association":"NONE","body":"https://crt.sh/?id=209801779&opt=zlint\r\n\"ERROR: Characters in labels of DNSNames MUST be alphanumeric, - , _ or *\"\r\n\r\nBut this is a client/email certificate that doesn't contain any SAN:dNSName fields.  I'm guessing that it's complaining (wrongly) about the email address in the Subject:CN."},"comment":{"url":"https://api.github.com/repos/zmap/zlint/issues/comments/329823003","html_url":"https://github.com/zmap/zlint/issues/175#issuecomment-329823003","issue_url":"https://api.github.com/repos/zmap/zlint/issues/175","id":329823003,"user":{"login":"zakird","id":201296,"avatar_url":"https://avatars1.githubusercontent.com/u/201296?v=4","gravatar_id":"","url":"https://api.github.com/users/zakird","html_url":"https://github.com/zakird","followers_url":"https://api.github.com/users/zakird/followers","following_url":"https://api.github.com/users/zakird/following{/other_user}","gists_url":"https://api.github.com/users/zakird/gists{/gist_id}","starred_url":"https://api.github.com/users/zakird/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zakird/subscriptions","organizations_url":"https://api.github.com/users/zakird/orgs","repos_url":"https://api.github.com/users/zakird/repos","events_url":"https://api.github.com/users/zakird/events{/privacy}","received_events_url":"https://api.github.com/users/zakird/received_events","type":"User","site_admin":false},"created_at":"2017-09-15T15:53:12Z","updated_at":"2017-09-15T15:53:12Z","author_association":"OWNER","body":"I'm not quite sure what the right approach is here. Thoughts:\r\n\r\n(1) We could not check CN for these errors and rely on the combination of (1) BRs state that CN must be in SAN and (2) we check SAN correctly\r\n\r\n(2) We could try to detect when something looks like an email and not apply checks\r\n\r\n(3) We could check in CN shows up in a not-DNSname-SAN (e.g., email) and then not check it\r\n\r\n(4) In the case that there's a `@` in CN, we could apply the checks to `.split('@')[1]`\r\n\r\nAll of these seem pretty hacky to me. But CN is also a hack so maybe that's just how it's gotta be.\r\n\r\nI'd appreciate others input on this one. "}}
{"actor":{"display_login":"zakird"}}