Preliminary research

Paperlock: testing X.509 Name Constraints across TLS validators

Oleh Konko · 1seal

AI-collected research leads through 16 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Explains differential testing of X.509 Name Constraints with positive and negative controls, normative requirements and explicit authorization preconditions. Links reproduction material for three fixed cases and separates earlier disclosures, specification ambiguity and open findings.

Record

Researcher

Oleh Konko

Published by

1seal

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Findings and fixes
• CERT cross-library note
• CERT delegation note
• CERT BoringSSL note
• Fixed-case reproduction archive

Tags

• tls
• parser-differential
• auth-bypass
• tooling
• owasp-a01-2021
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of Oleh Konko, first published at the original source. Preserved copies are kept so the citation survives its host.