Merge pull request #7833 from cert-manager-bot/cherry-pick-7816-to-release-1.18

cert-manager-prow[bot] · web-flow · commit e77920306540 · 2025-06-30T08:21:15.000Z
[release-1.18] fix: permit permitted URI domains in name constraints
diff --git a/pkg/util/pki/csr.go b/pkg/util/pki/csr.go
@@ -302,7 +302,7 @@ func GenerateCSR(crt *v1.Certificate, optFuncs ...GenerateCSROption) (*x509.Cert
 				return nil, err
 			}
 			nameConstraints.PermittedEmailAddresses = crt.Spec.NameConstraints.Permitted.EmailAddresses
-			nameConstraints.ExcludedURIDomains = crt.Spec.NameConstraints.Permitted.URIDomains
+			nameConstraints.PermittedURIDomains = crt.Spec.NameConstraints.Permitted.URIDomains
 		}
 
 		if crt.Spec.NameConstraints.Excluded != nil {

Original file line number	Diff line number	Diff line change
`@@ -302,7 +302,7 @@ func GenerateCSR(crt v1.Certificate, optFuncs ...GenerateCSROption) (x509.Cert`
`302`	`302`	`return nil, err`
`303`	`303`	`}`
`304`	`304`	`nameConstraints.PermittedEmailAddresses = crt.Spec.NameConstraints.Permitted.EmailAddresses`
`305`		`- nameConstraints.ExcludedURIDomains = crt.Spec.NameConstraints.Permitted.URIDomains`
	`305`	`+ nameConstraints.PermittedURIDomains = crt.Spec.NameConstraints.Permitted.URIDomains`
`306`	`306`	`}`
`307`	`307`
`308`	`308`	`if crt.Spec.NameConstraints.Excluded != nil {`