Reject chains where directoryName name constraints are involved

[aryan-25]

Motivation:

NameConstraintsPolicy (used as part of RFC5280Policy) determines whether a certificate is valid under the directoryName name constraints that are present in its issuing CA's nameConstraints extension. It currently does so by checking for exact equality between the constraint (which appears in either the permittedSubtrees or excludedSubtrees field) and the certificate's subject DN (or any directoryName value in its SAN).

However, per RFC 5280 §4.2.1.10 and §7.1, a subordinate certificate's DN is within the subtree if it has at least as many RDNs as the subtree DN and the two DNs match when trailing RDNs in the subordinate's DN are ignored. Additionally, per RFC 5280 §7.1, DN attribute values must first be normalized through the LDAP StringPrep algorithm before being compared. NameConstraintsPolicy only checks exact equality; it does not check whether the subordinate's DN is within the subtree per RFC 5280 §7.1 nor applies the StringPrep normalization.

We currently do not correctly validate directoryName name constraints. Performing the validation correctly involves implementing a complex algorithm. We should therefore just reject chains where directoryName name constraints are involved.

Modifications:

• Removed the directoryNameMatchesConstraint method.
• Updated NameConstraintsPolicy to simply reject chains involving a directoryName name constraint on both the permittedSubtrees and excludedSubtrees path.
• Updated all existing directoryName name constraints tests to now assert for failure.

Result:

We now fail-safe on chains involving directoryName name constraints.