rust: Add name constraints OID to critical extensions list

trail-of-forks · Oct 23, 2023 · 0a6dfa5 · 0a6dfa5
1 parent e61d527
commit 0a6dfa5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/rust/cryptography-x509-validation/src/policy/mod.rs b/src/rust/cryptography-x509-validation/src/policy/mod.rs
@@ -118,7 +118,7 @@ pub static WEBPKI_PERMITTED_ALGORITHMS: Lazy<HashSet<&AlgorithmIdentifier<'_>>>
 });
 
 const RFC5280_CRITICAL_CA_EXTENSIONS: &[asn1::ObjectIdentifier] =
-    &[BASIC_CONSTRAINTS_OID, KEY_USAGE_OID];
+    &[BASIC_CONSTRAINTS_OID, KEY_USAGE_OID, NAME_CONSTRAINTS_OID];
 const RFC5280_CRITICAL_EE_EXTENSIONS: &[asn1::ObjectIdentifier] = &[
     BASIC_CONSTRAINTS_OID,
     SUBJECT_ALTERNATIVE_NAME_OID,