Merge branch 'pyca:main' into dm/mldsa65-aws-lc

DarkaMaul · web-flow · commit 530aa923ada7 · 2026-03-26T09:30:22.000+01:00
diff --git a/.github/actions/fetch-vectors/action.yml b/.github/actions/fetch-vectors/action.yml
@@ -17,6 +17,6 @@ runs:
       with:
         repository: "C2SP/x509-limbo"
         path: "x509-limbo"
-        # Latest commit on the x509-limbo main branch, as of Mar 23, 2026.
-        ref: "7b5e0a93d0f9ba833e68b27ef0fed4559a3fa217" # x509-limbo-ref
+        # Latest commit on the x509-limbo main branch, as of Mar 25, 2026.
+        ref: "23a7ab348f27efef72d429f4faa92a3d8c23f720" # x509-limbo-ref
         persist-credentials: false
diff --git a/.github/requirements/build-requirements.txt b/.github/requirements/build-requirements.txt
@@ -167,24 +167,24 @@ typing-extensions==4.15.0 ; python_full_version < '3.11' \
     --hash=sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466 \
     --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
     # via -r build-requirements.in
-uv-build==0.11.0 \
-    --hash=sha256:03b158aaa4968099c814b6c2dd3e0e75191c1a49ec2a92451c694a331466355e \
-    --hash=sha256:131675b39b889df20aa5d0b8df508c250ce2c50349a527ca843a7c4cce9dc904 \
-    --hash=sha256:14a1aa27e6fad598a22a8c1cec7c10ee7102072539c32c0efc04c0cc29d13f93 \
-    --hash=sha256:30b46b8ad178a5ba2f126d00eeb01e76aae63a51211642ab6f525541d2d5d050 \
-    --hash=sha256:5169dc5bd05852263faf14fe877c3ac898cf8cfa9df3967f7dbabda1d7509218 \
-    --hash=sha256:68ec600208840c89c75849bc2050997ae098459f07a95a24d71ba7edb1b1d4c9 \
-    --hash=sha256:7d5b07d1c5dafe533c020acfb98a9c691837e140a638aee72fa8ac3f48412303 \
-    --hash=sha256:83ab0a3d638043ac2a3c1e554791cc7d0ec6a5766770a3062ab671d4892aa7ee \
-    --hash=sha256:88bffb3392899fe46d2a9cc31b24418ae7694d7d4182636969f9a0c584ebd0b8 \
-    --hash=sha256:8cea51b40a448d446a0f7e9699725e786fd53f028fa59df16e864df86e643291 \
-    --hash=sha256:98bece7038be95fef055a544b3258e2f79f78e60bb6329ae535974e638f6caf2 \
-    --hash=sha256:9b501ac28694a20622d6048e7b285536725ca16e39bd61c907656ef324e07baa \
-    --hash=sha256:b2c6758a935f27a784ebe694e60f0416e0ed491f3f70dceecd6b485100ffe7eb \
-    --hash=sha256:b3d2adf8a799cb87df3dba4cdbde6806755e00ef33cf5c4f2b4d77664498b9b8 \
-    --hash=sha256:ce37b0e7b75623b98c1f364bda1017cd6f501de0a4823363d5ff318fd1fb1a22 \
-    --hash=sha256:e566ed0411cf69d2110c9fc4437f72238572a10a3fcee54a5c99626ba29bb8ea \
-    --hash=sha256:ead158b7944c21c76d104ad34baadf2e8cd9ca5862889e494dbd9cce9ea96e59 \
-    --hash=sha256:eb77c4df0d6b1a54753c2258c766d9c0a39f0c3e1cd19e7949c6867c5cd75848 \
-    --hash=sha256:fd7ab11c24a9f2b71b758985d06a089d02330d274e8999fcb6ecb012e5d9fa3d
+uv-build==0.11.1 \
+    --hash=sha256:0e62a25e9b92a67b1ecf12538a1637cbdb6a8ae1c3fec8f698b926f5261a9d6b \
+    --hash=sha256:1796062d3ba78665a20e06b45d5bdbec189beef552f936d18a2b27d290116649 \
+    --hash=sha256:1c1719fddcedf238c69380d2dc11f36085dc983b1dd178fac9c3e354bbcbf6d6 \
+    --hash=sha256:2e5e606abb3acbdc1ae88734f6f3d6ef16960daa9a9464b250904144b63725fd \
+    --hash=sha256:36d57837779af8df6e46ab6aaa09d1767000058216232b63d6f1470bf9701e42 \
+    --hash=sha256:3985fa27b3350c8a70818795b2129e09e63dd114fd1388401ba7900a88943c00 \
+    --hash=sha256:4a05bea46db055825ffc054ee6dfde74e978432b3b3e7b1bcef2bd36b20cd31a \
+    --hash=sha256:4c53594b464e6409356dbd64a3a3d794d834b780bd6bdb9a219af713b3c1da21 \
+    --hash=sha256:57d3c3d4017d1ac738436949f60a7e1e737043f22bd4abb4ed152d15d3e9d12d \
+    --hash=sha256:6375c5e282efcf9a7a2b449bc4df46e1e6acb6b61d989a436fc0d42a28e69c96 \
+    --hash=sha256:7e3edaad8af3e6ec5429be72cb3b6a40d817aa22dfced56eb5061612507fc6c5 \
+    --hash=sha256:86bc63cc28a9badf91bbb2f8f36c0016e86c49a5b94aa7a444c30b0c01e9cdc3 \
+    --hash=sha256:8ff6725823bdd712ff340a696e4579f40348236c49d6adfd63235329962ecece \
+    --hash=sha256:b292ab6b4baebfba4065b6db53fd9fa5ae71752edf444d40c8fc8e3749deb6f3 \
+    --hash=sha256:d32a697528430fd9571487f7dada172e4cc6216ca8fcf43c2f4fce5f12cd0f3e \
+    --hash=sha256:e5ed41718d87de38d7b4bbd27d28109b8b678c12f255e47c19ace5a59b24cd53 \
+    --hash=sha256:ed1d7ea119a81c219c3d37758a2d271f4bd4ce22073725ab70e61408e30331bb \
+    --hash=sha256:f3f3f162dfd5575346d58e8adf5ad8589b34077941b077ec4e831ba283b90307 \
+    --hash=sha256:fb14ce9b9f2517a7a21c030bf97c6e277eec9680f6aa582e937944ca998b61e1
     # via -r build-requirements.in
diff --git a/.github/requirements/uv-requirements.txt b/.github/requirements/uv-requirements.txt
@@ -1,23 +1,23 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile --universal --python-version 3.8 --generate-hashes --refresh uv-requirements.in -o uv-requirements.txt
-uv==0.11.0 \
-    --hash=sha256:0a66d95ded54f76be0b3c5c8aefd4a35cc453f8d3042563b3a06e2dc4d54dbb6 \
-    --hash=sha256:130f5dd799e8f50ab5c1cdc51b044bb990330d99807c406d37f0b09b3fdf85fe \
-    --hash=sha256:15d2380214518375713c8da32e84e3d1834bee324b43a5dff8097b4d8b1694a9 \
-    --hash=sha256:16b7850ac8311eb04fe74c6ec1b3a7b6d7d84514bb6176877fcf5df9b7d6464a \
-    --hash=sha256:1960ae9c73d782a73b82e28e5f735b269743d18a467b3f14ec35b614435a2aef \
-    --hash=sha256:24fbec6a70cee6e2bf5619ff71e4c984664dbcc03dcf77bcef924febf9292293 \
-    --hash=sha256:30a08ee4291580784a5e276a1cbec8830994dba2ed5c94d878cce8b2121367cf \
-    --hash=sha256:30eed93f96a99a97e64543558be79c628d6197059227c0789f9921aa886e83f6 \
-    --hash=sha256:4b0ebbd7ae019ea9fc4bff6a07d0c1e1d6784d1842bbdcb941982d30e2391972 \
-    --hash=sha256:509f6e04ba3a38309a026874d2d99652d16fee79da26c8008886bc9e42bc37df \
-    --hash=sha256:50f3d0c4902558a2a06afb4666e6808510879fb52b0d8cc7be36e509d890fd88 \
-    --hash=sha256:74cf7401fe134dde492812e478bc0ece27f01f52be29ebbd103b4bb238ce2a29 \
-    --hash=sha256:7cbcf306d71d84855972a24a760d33f44898ac5e94b680de62cd28e30d91b69a \
-    --hash=sha256:7e16194cf933c9803478f83fb140cefe76cd37fc0d9918d922f6f6fbc6ca7297 \
-    --hash=sha256:801604513ec0cc05420b382a0f61064ce1c7800758ed676caba5ff4da0e3a99e \
-    --hash=sha256:8065cd54c2827588611a1de334901737373602cb64d7b84735a08b7d16c8932b \
-    --hash=sha256:81b73d7e9d811131636f0010533a98dd9c1893d5b7aa9672cc1ed00452834ba3 \
-    --hash=sha256:f2c3ec280a625c77ff6d9d53ebc0af9277ca58086b8ab2f8e66b03569f6aecb9 \
-    --hash=sha256:fb45be97641214df78647443e8fa0236deeef4c7995f2e3df55879b0bc42d71d
+uv==0.11.1 \
+    --hash=sha256:0d5cf3c1c96f8afd67072d80479a58c2d69471916bac4ac36cc55f2aa025dc8e \
+    --hash=sha256:1a7b74e5a15b9bc6e61ce807adeca5a2807f557d3f06a5586de1da309d844c1d \
+    --hash=sha256:36f4552b24acaa4699b02baeb1bb928202bb98d426dcc5041ab7ebae082a6430 \
+    --hash=sha256:3bc9632033c7a280342f9b304bd12eccb47d6965d50ea9ee57ecfaf4f1f393c4 \
+    --hash=sha256:41ccc438dbb905240a3630265feb25be1bda61656ec7c32682a83648a686f4aa \
+    --hash=sha256:424b5b412d37838ea6dc11962f037be98b92e83c6ec755509e2af8a4ca3fbf2a \
+    --hash=sha256:44f528ba3d66321cea829770982cccb14af142203e4e19d00ff0c23b28e3cd33 \
+    --hash=sha256:4fcc3d5fdea24181d77e7765bf9d16cdd9803fd524820c62c66f91b2e2644d5b \
+    --hash=sha256:57d38e8b6f6937e1521da568adf846bb89439c73e146e89a8ab2cfe7bb15657a \
+    --hash=sha256:5829a254c64b19420b9e48186182d162b01f8da0130e770cbb8851fd138bb820 \
+    --hash=sha256:5de9e43a32079b8d57093542b0cd8415adba5ed9944fa49076c0927f3ff927e1 \
+    --hash=sha256:8aa7e4983fabb06d0ba58e8b8c969d568ce495ad5f2f0426af97b55720f0dee1 \
+    --hash=sha256:b6169eb49d1d2b5df7a7079162e1242e49ad46c6590c55f05b182fa526963763 \
+    --hash=sha256:c2133b0532af0217bf252d981bded8bff0c770f174f91f20655f88705f28c03f \
+    --hash=sha256:c96a7310a051b1013efffe082f31d718bce0538d4abc20a716d529bf226b7c44 \
+    --hash=sha256:d4259027e80f4dcc9ae3dceddcd5407173d334484737166fc212e96bb760d6ea \
+    --hash=sha256:d6a1c4cdb1064e9ceaa59e89a7489dd196222a0b90cfb77ca37a909b5e024ea0 \
+    --hash=sha256:f13ae98a938effae5deb587a63e7e42f05d6ba9c1661903ef538e4e87b204f8c \
+    --hash=sha256:fb1f32ec6c7dffb7ae71afaf6bf1defca0bd20a73a25e61226210c0a3e8bb13d
     # via -r uv-requirements.in
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -50,6 +50,7 @@ jobs:
           # potential future MSRV.
           # noclippy due to: https://github.com/PyO3/pyo3/issues/5768
           - {VERSION: "3.14", NOXSESSION: "rust-noclippy,tests", RUST: "1.83.0"}
+          - {VERSION: "3.14", NOXSESSION: "rust-noclippy,tests", RUST: "1.83.0", OPENSSL: {TYPE: "aws-lc", VERSION: "v1.71.0"}}
           - {VERSION: "3.14", NOXSESSION: "rust,tests", RUST: "beta"}
           - {VERSION: "3.14", NOXSESSION: "rust,tests", RUST: "nightly"}
           - {VERSION: "3.14", NOXSESSION: "tests-rust-debug"}
@@ -118,7 +119,7 @@ jobs:
           echo "CFLAGS=${CFLAGS} -Werror=implicit-function-declaration" >> $GITHUB_ENV
           echo "RUSTFLAGS=-Clink-arg=-Wl,-rpath=${OSSL_PATH}/lib -Clink-arg=-Wl,-rpath=${OSSL_PATH}/lib64" >> $GITHUB_ENV
         if: matrix.PYTHON.OPENSSL
-      - run: cargo install bindgen-cli
+      - run: rustup run stable cargo install bindgen-cli
         if: matrix.PYTHON.OPENSSL.TYPE == 'boringssl' || matrix.PYTHON.OPENSSL.TYPE == 'aws-lc'
       - name: Cache rust and pip
         uses: ./.github/actions/cache
@@ -312,7 +313,7 @@ jobs:
         timeout-minutes: 2
         uses: ./.github/actions/fetch-vectors
 
-      - uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
         with:
           repo: pyca/infra
           workflow: build-macos-openssl.yml
@@ -373,7 +374,7 @@ jobs:
           key: ${{ matrix.PYTHON.NOXSESSION }}-${{ matrix.WINDOWS.ARCH }}-${{ steps.setup-python.outputs.python-version }}
       - run: python -m pip install -c ci-constraints-requirements.txt "nox[uv]" "tomli; python_version < '3.11'"
 
-      - uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
         with:
           repo: pyca/infra
           workflow: build-windows-openssl.yml
diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
@@ -43,7 +43,7 @@ jobs:
           echo "PYPI_URL=https://test.pypi.org/legacy/" >> $GITHUB_ENV
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'testpypi'
 
-      - uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
         with:
           path: tmpdist/
           run_id: ${{ github.event.inputs.run_id || github.event.workflow_run.id }}
diff --git a/.github/workflows/wheel-builder.yml b/.github/workflows/wheel-builder.yml
@@ -254,7 +254,7 @@ jobs:
         with:
           python-version: ${{ matrix.PYTHON.VERSION }}
         if: contains(matrix.PYTHON.VERSION, 'pypy')
-      - uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
         with:
           repo: pyca/infra
           workflow: build-macos-openssl.yml
@@ -353,7 +353,7 @@ jobs:
           toolchain: stable
           target: ${{ matrix.WINDOWS.RUST_TRIPLE }}
 
-      - uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+      - uses: dawidd6/action-download-artifact@8a338493df3d275e4a7a63bcff3b8fe97e51a927 # v19
         with:
           repo: pyca/infra
           workflow: build-windows-openssl.yml
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -90,6 +90,17 @@ Changelog
 * Added :doc:`/hazmat/primitives/hpke` support implementing :rfc:`9180` for
   hybrid authenticated encryption.
 
+.. _v46-0-6:
+
+46.0.6 - 2026-03-25
+~~~~~~~~~~~~~~~~~~~
+
+* **SECURITY ISSUE**: Fixed a bug where name constraints were not applied
+  to peer names during verification when the leaf certificate contains a
+  wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,
+  including those used by the Web PKI. Credit to **Oleh Konko (1seal)** for
+  reporting the issue. **CVE-2026-34073**
+
 .. _v46-0-5:
 
 46.0.5 - 2026-02-10
diff --git a/ci-constraints-requirements.txt b/ci-constraints-requirements.txt
@@ -18,7 +18,7 @@ build==1.2.2.post1 ; python_full_version < '3.9'
     # via
     #   cryptography (pyproject.toml)
     #   check-sdist
-build==1.4.0 ; python_full_version >= '3.9'
+build==1.4.1 ; python_full_version >= '3.9'
     # via
     #   cryptography (pyproject.toml)
     #   check-sdist
@@ -332,7 +332,7 @@ urllib3==2.2.3 ; python_full_version < '3.9'
     # via requests
 urllib3==2.6.3 ; python_full_version >= '3.9'
     # via requests
-uv==0.11.0
+uv==0.11.1
     # via nox
 virtualenv==21.2.0
     # via nox
diff --git a/pyproject.toml b/pyproject.toml
@@ -2,7 +2,7 @@
 # These requirements must be kept sync with the requirements in
 # ./.github/requirements/build-requirements.{in,txt}
 requires = [
-    "maturin>=1.9.4,<2,!=1.11.0",
+    "maturin>=1.9.4,<2,!=1.12.0",
 
     # Must be kept in sync with `project.dependencies`
     "cffi>=1.14; platform_python_implementation != 'PyPy' and python_version == '3.8'",
diff --git a/src/rust/cryptography-x509-verification/src/lib.rs b/src/rust/cryptography-x509-verification/src/lib.rs
@@ -162,9 +162,7 @@ impl<'a, 'chain> NameChain<'a, 'chain> {
                 // match exactly one subdomain of `foo.com`. Therefore, the NC's matching
                 // set is a strict superset of any possible wildcard SAN pattern.
                 match (DNSConstraint::new(constraint.0), DNSPattern::new(name.0)) {
-                    (Some(constraint), Some(name)) => {
-                        Ok(Applied(constraint.matches(name.inner_name())))
-                    }
+                    (Some(constraint), Some(name)) => Ok(Applied(constraint.matches(&name))),
                     (_, None) => Err(ValidationError::new(ValidationErrorKind::Other(format!(
                         "unsatisfiable DNS name constraint: malformed SAN {}",
                         name.0
diff --git a/src/rust/cryptography-x509-verification/src/types.rs b/src/rust/cryptography-x509-verification/src/types.rs
@@ -138,19 +138,6 @@ impl<'a> DNSPattern<'a> {
             },
         }
     }
-
-    /// Returns the inner `DNSName` within this `DNSPattern`, e.g.
-    /// `foo.com` for `*.foo.com` or `example.com` for `example.com`.
-    ///
-    /// This API must not be used to bypass pattern matching; it exists
-    /// solely to enable checks that only require the inner name, such
-    /// as Name Constraint checks.
-    pub fn inner_name(&self) -> &DNSName<'a> {
-        match self {
-            DNSPattern::Exact(dnsname) => dnsname,
-            DNSPattern::Wildcard(dnsname) => dnsname,
-        }
-    }
 }
 
 /// A `DNSConstraint` represents a DNS name constraint as defined in [RFC 5280 4.2.1.10].
@@ -163,35 +150,45 @@ impl<'a> DNSConstraint<'a> {
         DNSName::new(pattern).map(Self)
     }
 
-    /// Returns true if this `DNSConstraint` matches the given name.
+    /// Returns true if this `DNSConstraint` matches the given `DNSPattern`.
     ///
     /// Constraint matching is defined by RFC 5280: any DNS name that can
     /// be constructed by simply adding zero or more labels to the left-hand
     /// side of the name satisfies the name constraint.
     ///
-    /// ```rust
-    /// # use cryptography_x509_verification::types::{DNSConstraint, DNSName};
-    /// let example_com = DNSName::new("example.com").unwrap();
-    /// let badexample_com = DNSName::new("badexample.com").unwrap();
-    /// let foo_example_com = DNSName::new("foo.example.com").unwrap();
-    /// assert!(DNSConstraint::new(example_com.as_str()).unwrap().matches(&example_com));
-    /// assert!(DNSConstraint::new(example_com.as_str()).unwrap().matches(&foo_example_com));
-    /// assert!(!DNSConstraint::new(example_com.as_str()).unwrap().matches(&badexample_com));
-    /// ```
-    pub fn matches(&self, name: &DNSName<'_>) -> bool {
-        // NOTE: This may seem like an obtuse way to perform label matching,
-        // but it saves us a few allocations: doing a substring check instead
-        // would require us to clone each string and do case normalization.
-        // Note also that we check the length in advance: Rust's zip
-        // implementation terminates with the shorter iterator, so we need
-        // to first check that the candidate name is at least as long as
-        // the constraint it's matching against.
-        name.as_str().len() >= self.0.as_str().len()
-            && self
-                .0
-                .rlabels()
-                .zip(name.rlabels())
-                .all(|(a, o)| a.eq_ignore_ascii_case(o))
+    /// On top of what RFC 5280 specifies, we define behavior for wildcard
+    /// patterns (which are not covered by RFC 5280): a wildcard pattern
+    /// matches a constraint if the pattern matches the constraint's inner name,
+    /// _or_ if the pattern's inner name matches the constraint.
+    /// This allows us to reject DNS names like `*.example.com` when
+    /// the constraint is `example.com` or `bar.example.com`.
+    pub fn matches(&self, name: &DNSPattern<'_>) -> bool {
+        match name {
+            DNSPattern::Exact(name) => {
+                // NOTE: This may seem like an obtuse way to perform label matching,
+                // but it saves us a few allocations: doing a substring check instead
+                // would require us to clone each string and do case normalization.
+                // Note also that we check the length in advance: Rust's zip
+                // implementation terminates with the shorter iterator, so we need
+                // to first check that the candidate name is at least as long as
+                // the constraint it's matching against.
+                name.as_str().len() >= self.0.as_str().len()
+                    && self
+                        .0
+                        .rlabels()
+                        .zip(name.rlabels())
+                        .all(|(a, o)| a.eq_ignore_ascii_case(o))
+            }
+            DNSPattern::Wildcard(inner) => {
+                // NOTE: This check is not as simple as a single pattern match,
+                // since we need two subtly distinct cases here:
+                // 1. Constraint `bar.example.com` on `*.example.com`
+                // 2. Constraint `example.com` on `*.example.com`
+                // The first cases is handled by `DNSPattern::matches`, and the second is handled
+                // by `DNSConstraint::matches`.
+                name.matches(&self.0) || self.matches(&DNSPattern::Exact(inner.clone()))
+            }
+        }
     }
 }
 
@@ -597,14 +594,33 @@ mod tests {
         let example_com = DNSConstraint::new("example.com").unwrap();
 
         // Exact domain and arbitrary subdomains match.
-        assert!(example_com.matches(&DNSName::new("example.com").unwrap()));
-        assert!(example_com.matches(&DNSName::new("foo.example.com").unwrap()));
-        assert!(example_com.matches(&DNSName::new("foo.bar.baz.quux.example.com").unwrap()));
+        assert!(example_com.matches(&DNSPattern::new("example.com").unwrap()));
+        assert!(example_com.matches(&DNSPattern::new("foo.example.com").unwrap()));
+        assert!(example_com.matches(&DNSPattern::new("foo.bar.baz.quux.example.com").unwrap()));
 
         // Parent domains, distinct domains, and substring domains do not match.
-        assert!(!example_com.matches(&DNSName::new("com").unwrap()));
-        assert!(!example_com.matches(&DNSName::new("badexample.com").unwrap()));
-        assert!(!example_com.matches(&DNSName::new("wrong.com").unwrap()));
+        assert!(!example_com.matches(&DNSPattern::new("com").unwrap()));
+        assert!(!example_com.matches(&DNSPattern::new("badexample.com").unwrap()));
+        assert!(!example_com.matches(&DNSPattern::new("wrong.com").unwrap()));
+    }
+
+    #[test]
+    fn test_dnsconstraint_matches_wildcard() {
+        let com = DNSConstraint::new("com").unwrap();
+        let example_com = DNSConstraint::new("example.com").unwrap();
+        let bar_example_com = DNSConstraint::new("bar.example.com").unwrap();
+        let baz_bar_example_com = DNSConstraint::new("baz.bar.example.com").unwrap();
+        let any_example_com = DNSPattern::new("*.example.com").unwrap();
+
+        assert!(com.matches(&any_example_com));
+        assert!(example_com.matches(&any_example_com));
+        assert!(bar_example_com.matches(&any_example_com));
+
+        // A constraint on `baz.bar.example.com` doesn't match `*.example.com`,
+        // since `baz.bar.example.com` matches zero or more sublabels of
+        // `baz.bar.example.com` while `*.example.com` matches exactly one
+        // sublabel of `example.com`.
+        assert!(!baz_bar_example_com.matches(&any_example_com));
     }
 
     #[test]
