Handle X509 policy constraints on macOS.

dotnet · Jan 26, 2021 · fb001e6 · fb001e6
1 parent 0fcfa46
commit fb001e6
Show file tree

Hide file tree

Showing 2 changed files with 358 additions and 37 deletions.
diff --git a/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509chain.c b/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_x509chain.c
@@ -171,6 +171,8 @@ static void MergeStatusCodes(CFTypeRef key, CFTypeRef value, void* context)
         *pStatus |= PAL_X509ChainHasNotSupportedCriticalExtension;
     else if (CFEqual(keyString, CFSTR("NameConstraints")))
         *pStatus |= PAL_X509ChainInvalidNameConstraints;
+    else if (CFEqual(keyString, CFSTR("PolicyConstraints")))
+        *pStatus |= PAL_X509ChainInvalidPolicyConstraints;
     else if (CFEqual(keyString, CFSTR("UnparseableExtension")))
     {
         // 10.15 introduced new status code value which is not reported by Windows. Ignoring for now.