@blamejs/pki 0.3.24 → 0.3.26

package/lib/constants.js

@@ -223,6 +223,21 @@ var LIMITS = {
   // overridable (opts.maxDepth / opts.maxCandidatesConsidered).
   PATH_BUILD_MAX_DEPTH: 20,
   PATH_BUILD_MAX_CANDIDATES: 1000,
+  // AIA caIssuers network-fetch bounds (pki.path.build with opts.fetchAia). Fetching an issuer over the
+  // network from an untrusted certificate's authorityInfoAccess opens an SSRF / amplification surface (a
+  // hostile mesh where each fetched cert advertises a fresh caIssuers URL). PATH_AIA_MAX_FETCHES is the
+  // TOTAL network GET budget across a whole build() call (a breach throws path/aia-fetch-limit);
+  // PATH_AIA_MAX_PER_CERT caps how many caIssuers URIs are tried for a single certificate (an AIA MAY carry
+  // many). Both are small by default and operator-overridable (opts.maxAiaFetches / opts.maxAiaPerCert).
+  PATH_AIA_MAX_FETCHES: 10,
+  PATH_AIA_MAX_PER_CERT: 3,
+  // A caIssuers response is one certificate or a short chain -- never a 24 MiB bundle. Bounding the AIA
+  // fetch below the general HTTP ceiling (and capping the certificate COUNT a single response contributes)
+  // stops a hostile-but-TLS-trusted AIA endpoint from forcing tens of thousands of certificate parses per
+  // fetch (parse work bounded by COUNT, not only by bytes). Both operator-overridable (opts.maxResponseBytes
+  // tightens downward only; the count cap is a fixed defense).
+  PATH_AIA_MAX_RESPONSE_BYTES: BYTES.mib(1),
+  PATH_AIA_MAX_CERTS_PER_RESPONSE: 16,
   // PKCS#12 container ceilings. A PFX carries lists at three altitudes
   // (ContentInfos per AuthenticatedSafe, SafeBags per SafeContents,
   // attributes per bag) and can chain fresh DER blobs inside OCTET STRINGs,

package/lib/est.js

@@ -56,7 +56,6 @@ var oid = require("./oid");
 var constants = require("./constants");
 var cms = require("./schema-cms");
 var x509 = require("./schema-x509");
-var crl = require("./schema-crl");
 var pkcs8 = require("./schema-pkcs8");
 var csr = require("./schema-csr");
 var frameworkError = require("./framework-error");
@@ -66,8 +65,6 @@ var retryAfter = require("./http-retry-after");
 
 var EstError = frameworkError.EstError;
 function E(code, message, cause) { return new EstError(code, message, cause); }
-
-var ID_DATA = oid.byName("data");
 var ID_SIGNED_DATA = oid.byName("signedData");
 var OID_CHALLENGE_PASSWORD = oid.byName("challengePassword");
 var OID_DECRYPT_KEY_ID = oid.byName("decryptKeyID");
@@ -212,36 +209,9 @@ function splitMultipartMixed(body, contentType) {
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
 function parseCertsOnly(der) {
-  var r;
-  try { r = cms.parse(der); }
-  catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-response", "the EST response did not decode as CMS: " + ((e && e.message) || String(e)), e); }
-  if (r.contentTypeName !== "signedData") throw E("est/not-certs-only", "an EST certs-only response must be a CMS SignedData (RFC 5272 sec. 4.1)");
-  if (r.encapContentInfo.eContentType !== ID_DATA || r.encapContentInfo.eContent !== null) {
-    throw E("est/not-certs-only", "a certs-only Simple PKI Response must carry id-data with no eContent (RFC 5272 sec. 4.1)");
-  }
-  if (r.signerInfos.length !== 0) throw E("est/not-certs-only", "a certs-only Simple PKI Response must have empty signerInfos (RFC 5272 sec. 4.1)");
-  if (!r.certificates || r.certificates.length === 0) throw E("est/no-certificates", "an EST certs-only response must contain at least one certificate (RFC 7030 sec. 4.1.3)");
-  for (var i = 0; i < r.certificates.length; i++) {
-    if (r.certificates[i].tagClass !== "universal") throw E("est/bad-certificate-choice", "EST exchanges plain X.509 certificates; a tagged CertificateChoices alternative is not permitted (RFC 7030)");
-    // A universal-SEQUENCE CertificateChoice must be a well-formed X.509
-    // Certificate, not merely any SEQUENCE. Parse it structurally (still
-    // returning the raw bytes below) so a malformed response fails closed.
-    try { x509.parse(r.certificates[i].bytes); }
-    catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-certificate", "a certs-only response carried a non-certificate in its certificates field (RFC 5272 sec. 4.1)", e); }
-  }
-  var crls = r.crls || [];
-  for (var j = 0; j < crls.length; j++) {
-    // A RevocationInfoChoice is a plain X.509 CertificateList or a [1] otherRevInfo;
-    // EST surfaces CRLs, so reject the tagged alternative and structurally validate
-    // each universal entry as a CertificateList (mirrors the certificate path).
-    if (crls[j].tagClass !== "universal") throw E("est/bad-crl", "an EST response CRL must be a plain X.509 CertificateList, not a tagged otherRevInfo alternative (RFC 5652 sec. 10.2.1)");
-    try { crl.parse(crls[j].bytes); }
-    catch (e) { if (e instanceof EstError) throw e; throw E("est/bad-crl", "a response carried a non-CRL in its crls field", e); }
-  }
-  return {
-    certificates: r.certificates.map(function (c) { return c.bytes; }),
-    crls: crls.map(function (c) { return c.bytes; }),
-  };
+  // The certs-only Simple PKI Response shape is a CMS concern shared with AIA path building; the reader lives
+  // in schema-cms. The "est" prefix keeps the exact est/* codes (est/not-certs-only, est/no-certificates, ...).
+  return cms.parseCertsOnly(der, E, "est");
 }
 
 // Pick the issued certificate from a certs-only response by matching its public
@@ -727,9 +697,30 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
   var redirects = 0;
   var authTried = false;
   var initialOrigin = url.origin;   // the origin the caller intended to authenticate to
-  var tls = budgets.tls;            // narrowed (mTLS client identity stripped) on a cross-origin hop
+  // The per-hop TLS: the origin-specific identity (mTLS cert/key + pinned SNI) is sent ONLY to the caller's
+  // configured origin; a cross-origin hop gets a narrowed copy with those stripped (checkServerIdentity kept).
+  // Derived FRESH from budgets.tls each hop (the ACME _tlsFor model) so a redirect back to the original origin
+  // restores its identity rather than permanently losing the SNI at the first cross-origin boundary.
+  function _tlsFor(u) {
+    var t = budgets.tls;
+    if (t && u.origin !== initialOrigin && (t.cert != null || t.key != null || t.servername != null)) {
+      t = Object.assign({}, t);
+      delete t.cert; delete t.key; delete t.servername;
+    }
+    return t;
+  }
+  // The per-hop Authorization: the HTTP Basic credential (established after a 401 on the caller's origin) is
+  // sent ONLY to that origin. A cross-origin hop travels unauthenticated, but a redirect back to the origin
+  // restores it -- so an authenticated flow that bounces off-origin and returns still completes (mirrors _tlsFor).
+  var authValue = null;
+  function _headersFor(u) {
+    if (!authValue || u.origin !== initialOrigin) return headers;
+    var hh = Object.assign({}, headers);
+    hh.authorization = authValue;
+    return hh;
+  }
   function step() {
-    return transport({ method: method, url: url.href, headers: headers, body: body, tls: tls, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
+    return transport({ method: method, url: url.href, headers: _headersFor(url), body: body, tls: _tlsFor(url), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }).then(function (res) {
       res = res || {};
       // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
       // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
@@ -752,16 +743,10 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
           body = null;
           if (headers["content-type"]) { headers = Object.assign({}, headers); delete headers["content-type"]; }
         }
-        var prevOrigin = url.origin;
         url = _redirectTarget(url, h.location, method, opts);
-        // Credentials MUST NOT cross an origin boundary. A redirect to a different web origin (even a
-        // permitted cross-origin GET) drops BOTH the HTTP Basic Authorization header AND the mTLS
-        // client identity (cert/key), so a prior 401's password and the caller's certificate + proof
-        // of private-key possession are never presented to a different server.
-        if (url.origin !== prevOrigin) {
-          if (headers.authorization) { headers = Object.assign({}, headers); delete headers.authorization; }
-          if (tls && (tls.cert || tls.key)) { tls = Object.assign({}, tls); delete tls.cert; delete tls.key; }
-        }
+        // Credentials MUST NOT cross an origin boundary: the HTTP Basic Authorization header and the
+        // ORIGIN-SPECIFIC TLS identity (mTLS cert/key + pinned SNI) are BOTH scoped per hop (_headersFor /
+        // _tlsFor), so each is absent off-origin but restored on a hop back to the caller's configured origin.
         redirects += 1;
         return step();
       }
@@ -774,7 +759,9 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
         var www = String(h["www-authenticate"] || "");
         if (!_hasBasicChallenge(www)) throw E("est/auth-required", "the server requires an unsupported HTTP authentication scheme (only Basic is supported): " + www);
         if (opts.username === undefined && opts.password === undefined) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
-        headers = Object.assign({}, headers, { authorization: "Basic " + Buffer.from((opts.username || "") + ":" + (opts.password || ""), "utf8").toString("base64") });
+        // Establish the credential as origin-scoped state (_headersFor attaches it only on the initial origin),
+        // never a mutation of the shared headers that would leak across a cross-origin redirect.
+        authValue = "Basic " + Buffer.from((opts.username || "") + ":" + (opts.password || ""), "utf8").toString("base64");
         authTried = true;
         return step();
       }

package/lib/http-transport.js

@@ -39,6 +39,7 @@
 var nodeHttps = require("node:https");
 var nodeNet = require("node:net");
 var nodeTls = require("node:tls");
+var nodeDns = require("node:dns");
 var constants = require("./constants");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
@@ -97,11 +98,81 @@ function _systemCa() {
   return out;
 }
 
+// Classify a bare IP string (no brackets) as a private / loopback / link-local / reserved destination an
+// untrusted URL must not reach: RFC 1918 + loopback + this-network + multicast/reserved + 169.254 (cloud
+// metadata) + CGNAT for IPv4, and loopback / unspecified / IPv4-mapped / ULA (fc00::/7) + link-local (fe80::/10)
+// for IPv6. This is the SAME range set the AIA literal pre-check applies (pki.path.build reuses it), enforced
+// here at DNS-RESOLUTION time so a hostname pointing AT an internal address is caught too. A malformed IP fails
+// CLOSED (net.isIP === 0 -> not a v4/v6 arm -> the caller treats a non-IP as un-judgeable, never as public).
+function _isBlockedIp(ip) {
+  var fam = nodeNet.isIP(ip);
+  if (fam === 4) {
+    // net.isIP === 4 guarantees exactly four octets 0..255. Block the COMPLETE IANA special-purpose /
+    // non-global set (RFC 6890) so an untrusted destination can reach ONLY globally-routable public space.
+    var o = ip.split("."), a = +o[0], b = +o[1], c = +o[2];
+    return a === 0 || a === 10 || a === 127 || a >= 224 ||                 // this-network / RFC1918 10/8 / loopback / multicast 224/4 + reserved 240/4 + broadcast
+      (a === 100 && b >= 64 && b <= 127) ||                                 // 100.64/10 CGNAT
+      (a === 169 && b === 254) ||                                           // 169.254/16 link-local (cloud metadata)
+      (a === 172 && b >= 16 && b <= 31) ||                                  // 172.16/12
+      (a === 192 && b === 168) ||                                           // 192.168/16
+      (a === 192 && b === 0 && (c === 0 || c === 2)) ||                      // 192.0.0/24 IETF protocol + 192.0.2/24 TEST-NET-1
+      (a === 192 && b === 88 && c === 99) ||                                 // 192.88.99/24 6to4 relay anycast (deprecated)
+      (a === 198 && (b === 18 || b === 19)) ||                              // 198.18/15 benchmarking
+      (a === 198 && b === 51 && c === 100) ||                               // 198.51.100/24 TEST-NET-2
+      (a === 203 && b === 0 && c === 113);                                   // 203.0.113/24 TEST-NET-3
+  }
+  if (fam === 6) {
+    var l = ip.toLowerCase();
+    if (l.indexOf("::ffff:") === 0) return true;                            // IPv4-mapped -- may embed a private v4; block all (fail-closed)
+    var parts = l.split(":");
+    var h = parseInt(parts[0], 16);                                         // first hextet ("" for a leading "::" -> NaN -> not in 2000::/3 -> blocked)
+    if (!(h >= 0x2000 && h <= 0x3fff)) return true;                         // outside global unicast 2000::/3: loopback/ULA/link-local/site-local/multicast(ff00::/8)/unspecified/unallocated
+    // Within 2000::/3, carve out the non-globally-routable special-purpose sub-ranges (IANA IPv6 Special-Purpose
+    // Address Registry) an attacker could route to an internal service: a first-hextet allow of the whole block
+    // would admit them. The second hextet is 0 when "::" compresses it (parts[1] empty).
+    var h2 = parts[1] ? parseInt(parts[1], 16) : 0;
+    if (h === 0x2002) return true;                                          // 2002::/16 6to4 (embeds an IPv4 that may be private)
+    if (h === 0x2001 && h2 < 0x0200) return true;                           // 2001::/23 IETF protocol assignments (Teredo / benchmarking / ORCHID / AMT / ...)
+    if (h === 0x2001 && h2 === 0x0db8) return true;                         // 2001:db8::/32 documentation (RFC 3849)
+    if (h === 0x3fff && h2 < 0x1000) return true;                           // 3fff::/20 documentation (RFC 9637)
+    return false;
+  }
+  return false;
+}
+
+// A DNS-rebinding-safe SSRF filter, installed as node's `lookup` ONLY when a request opts into
+// blockPrivateAddresses (the AIA fetch of an untrusted-cert URL). node connects to EXACTLY the address this
+// returns -- no second resolution -- so checking the resolved address here PINS it, closing the resolve/connect
+// TOCTOU. Any private / loopback / link-local result fails the lookup, which surfaces as transport/blocked-address.
+function _blockedAddrErr(hostname, address) {
+  var e = new Error("refusing to connect to " + hostname + " -> " + address + " (private / loopback / link-local address blocked)");
+  e.pkiBlockedAddress = true;
+  return e;
+}
+// Built over an injectable resolver (defaults to nodeDns.lookup) so every branch -- a resolve error, the
+// options.all array shape, a blocked result, a permitted result -- is unit-testable without a live DNS.
+function _makeGuardedLookup(lookupFn) {
+  return function guardedLookup(hostname, options, callback) {
+    lookupFn(hostname, options || {}, function (err, address, family) {
+      if (err) return callback(err);
+      if (Array.isArray(address)) {   // options.all -> [{ address, family }, ...]; reject if ANY resolved address is blocked
+        for (var i = 0; i < address.length; i++) if (_isBlockedIp(address[i].address)) return callback(_blockedAddrErr(hostname, address[i].address));
+        return callback(null, address);
+      }
+      if (_isBlockedIp(address)) return callback(_blockedAddrErr(hostname, address));
+      return callback(null, address, family);
+    });
+  };
+}
+var _guardedLookup = _makeGuardedLookup(nodeDns.lookup);
+
 // Classify a node request/TLS error into the transport's fail-closed verdict: a
-// protocol-version mismatch is the TLS floor; a certificate / identity / handshake
-// failure is a server-authentication failure; anything else is a generic transport
-// error. Every arm threads the raw fault as `.cause`, so the diagnostic survives.
+// blocked-address lookup rejection; a protocol-version mismatch is the TLS floor; a
+// certificate / identity / handshake failure is a server-authentication failure;
+// anything else is a generic transport error. Every arm threads the raw fault as
+// `.cause`, so the diagnostic survives.
 function _classifyError(e, C) {
+  if (e && e.pkiBlockedAddress) return C("blocked-address");
   var s = String((e && e.code) || "") + " " + String((e && e.message) || "");
   if (/PROTOCOL_VERSION|UNSUPPORTED_PROTOCOL|VERSION_TOO_LOW|WRONG_VERSION|NO_PROTOCOLS_AVAILABLE|INAPPROPRIATE_FALLBACK/i.test(s)) return C("tls-floor");
   if (/CERT|SELF.?SIGNED|VERIFY|ALTNAME|HOSTNAME|DEPTH_ZERO|LOCAL_ISSUER|HANDSHAKE|\bSSL\b|\bTLS\b/i.test(s)) return C("server-auth-failed");
@@ -114,7 +185,7 @@ function _classifyError(e, C) {
  * @since      0.3.16
  * @status     experimental
  * @spec       RFC 7030, RFC 8996
- * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770)
+ * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770), ssrf (CWE-918)
  * @related    pki.est.cacerts, pki.est.simpleenroll
  *
  * Build a fail-closed `node:https` transport: `transport(request) -> Promise<{ status,
@@ -139,6 +210,7 @@ function _classifyError(e, C) {
  *   - `tls.minVersion` -- 'TLSv1.2' (default) or 'TLSv1.3'; never below the floor.
  *   - `tls.servername` / `tls.checkServerIdentity` -- SNI + RFC 6125 identity; may tighten, never disable.
  *   - `timeout` -- ms (default C.TIME.seconds(30)); `maxResponseBytes` -- default LIMITS.HTTP_MAX_RESPONSE_BYTES, tightenable downward only.
+ *   - `blockPrivateAddresses` -- boolean; when true, an IP-literal host OR a hostname resolving to a private / loopback / link-local address is refused (`transport/blocked-address`), and a resolved address is pinned for the connection. For fetching an untrusted-certificate URL (AIA caIssuers); default false.
  * @example
  *   var t = pki.transport.https({ tls: { anchors: [caPem] } });
  *   var res = await t({ method: "GET", url: "https://ca.example/.well-known/est/cacerts" });
@@ -240,11 +312,23 @@ function httpsTransport(defaults) {
         return callerCsi(host, cert2);
       };
     }
+    // SSRF at resolution time: when a request opts in (the AIA fetch of an untrusted-cert URL), install a
+    // lookup that refuses -- and pins -- a private / loopback / link-local resolved address, so a hostname
+    // pointing at an internal service is blocked even though the literal-address check saw only a DNS name.
+    // A STRICT boolean true (a truthy string/object is treated as absent) keeps a malformed config fail-open-free.
+    var blockPrivate = (request.blockPrivateAddresses !== undefined ? request.blockPrivateAddresses : defaults.blockPrivateAddresses) === true;
+    if (blockPrivate) {
+      // Node does NOT invoke a custom `lookup` for an IP-LITERAL host (there is nothing to resolve), so the
+      // resolver alone would let a literal private / loopback / link-local destination through. Reject a blocked
+      // literal here, before installing the resolver -- so the option blocks a literal AND a resolved hostname.
+      if (_isBlockedIp(host)) throw E(C("blocked-address"), "refusing to connect to the private / loopback / link-local address literal " + host);
+      options.lookup = _guardedLookup;
+    }
 
     return { options: options, timeout: timeout, maxBytes: maxBytes, body: body };
   }
 
-  return function transport(request) {
+  var _transportFn = function transport(request) {
     request = request || {};
     var prep;
     try { prep = _prepare(request); }
@@ -318,6 +402,11 @@ function httpsTransport(defaults) {
       } catch (e) { fail(C("transport-error"), "the request could not be initiated: " + ((e && e.message) || String(e)), e); }
     });
   };
+  // Advertise that this transport HONORS the blockPrivateAddresses request flag (it filters and pins a resolved
+  // address). A consumer of an UNTRUSTED URL (pki.path.build's AIA fetch) checks this marker before relying on the
+  // flag for SSRF protection -- an injected transport that does not set it is treated as unguarded (fail-closed).
+  _transportFn.blocksPrivateAddresses = true;
+  return _transportFn;
 }
 
-module.exports = { https: httpsTransport };
+module.exports = { https: httpsTransport, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT };

package/lib/inspect.js

@@ -381,6 +381,26 @@ var EXT_RENDERERS = {
   },
   cRLDistributionPoints: _renderCrlDp,
   freshestCRL: _renderCrlDp,
+  authorityInfoAccess: function (decoded, inner) {
+    // AccessDescription list: <accessMethod> - <accessLocation>. The method resolves to its name (caIssuers /
+    // ocsp); the accessLocation is a GeneralName (a URI in the common case). An unregistered method / an
+    // uncommon accessLocation tag falls back to the raw OID / bracketed tag rather than dropping the entry.
+    var LABEL = { caIssuers: "CA Issuers", ocsp: "OCSP" };
+    return (decoded || []).map(function (ad) {
+      var m = null;
+      try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
+      var loc = ad.accessLocation || {}, lv;
+      // The string choices (URI/DNS/email) are IA5String values already control-byte-rejected at decode by the
+      // CVE-2009-2408 guard, so they are safe to emit directly. The iPAddress choice is a RAW 4/16-byte Buffer --
+      // render it through _ipString (never raw), so a byte such as 0x0a cannot inject a line and spoof a field.
+      if (loc.tag === 6) lv = "URI:" + loc.value;
+      else if (loc.tag === 2) lv = "DNS:" + loc.value;
+      else if (loc.tag === 1) lv = "email:" + loc.value;
+      else if (loc.tag === 7) lv = "IP:" + _ipString(loc.value);
+      else lv = typeof loc.value === "string" ? loc.value : "[" + loc.tag + "]";
+      return inner + (LABEL[m] || m || ad.accessMethod) + " - " + lv;
+    }).join("\n");
+  },
   nameConstraints: function (decoded, inner) {
     var ncLines = [];
     ["permittedSubtrees:Permitted", "excludedSubtrees:Excluded"].forEach(function (pair) {

package/lib/lint.js

@@ -191,32 +191,9 @@ function _serialOctets(cert) {
   return buf.length;
 }
 
-// dNSName syntax (a representative CABF check): no whitespace, no leading/trailing dot,
-// no empty label, and no underscore (forbidden in a dNSName). IDN must already be an
-// A-label (we do not transcode). Returns a reason string, or null when well-formed.
-function _dnsNameProblem(s) {
-  if (typeof s !== "string" || !s.length) return "empty";
-  if (s.length > 253) return "exceeds 253 octets";
-  if (/\s/.test(s)) return "whitespace";
-  if (s.charAt(0) === "." || s.charAt(s.length - 1) === ".") return "leading/trailing dot";
-  if (s.indexOf("_") !== -1) return "underscore forbidden in dNSName";
-  var labels = s.split(".");
-  for (var i = 0; i < labels.length; i++) {
-    var label = labels[i];
-    if (label.length === 0) return "empty label";
-    if (label.length > 63) return "label exceeds 63 octets";
-    // A leftmost "*" wildcard label is permitted only when at least one more label follows
-    // (a bare "*" is not a domain name).
-    if (i === 0 && label === "*") {
-      if (labels.length < 2) return "bare wildcard";
-      continue;
-    }
-    // RFC 1034 preferred name syntax: an LDH label that neither begins nor ends with a
-    // hyphen. Rejects "-bad" / "bad-" and any non-letter/digit/hyphen character.
-    if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/i.test(label)) return "invalid label syntax";
-  }
-  return null;
-}
+// dNSName syntax check -- the shared RFC 5280 sec. 4.2.1.6 / RFC 1034 preferred-name validator (pkix), reused
+// so the linter and the identity comparators agree on what a well-formed dNSName is. Returns a reason or null.
+function _dnsNameProblem(s) { return pkix.dnsNameProblem(s); }
 
 // A genuine IPv4 or IPv6 literal -- a CN validated against an iPAddress SAN rather than a
 // dNSName. Routed through the shared strict validator (no node:net, so the toolkit needs no