critical in nameConstraints lost after last refactoring

trailofbits · Jan 21, 2020 · 9317054 · 9317054
1 parent c5cfe92
commit 9317054
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/roles/strongswan/defaults/main.yml b/roles/strongswan/defaults/main.yml
@@ -17,7 +17,8 @@ subjectAltName: >-
   {%- if ipv6_support -%},IP:{{ ansible_default_ipv6['address'] }}{%- endif -%}
 subjectAltName_USER: "email:{{ item }}@{{ openssl_constraint_random_id }}"
 nameConstraints: >-
-  permitted;{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{{- '/255.255.255.255' if subjectAltName_type == 'IP' else '' -}}
+  critical
+  ,permitted;{{ subjectAltName_type }}:{{ IP_subject_alt_name }}{{- '/255.255.255.255' if subjectAltName_type == 'IP' else '' -}}
   {%- if subjectAltName_type == 'IP' -%}
   ,permitted;DNS:{{ openssl_constraint_random_id }}
   {%- else -%}