Update the "Known Issues"

Mention that some old cryptographic library versions lack the
functionality to implement ignoring the Subject field (and thus the
Common Name) when establishing DoT connections.

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 5e6097a09069a6b6e6bafa5eb926aa411ab7231a..16ec7999ddf1c0815c7877c43a16cf1e4afaea60 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -42,7 +42,16 @@ Security Fixes
 Known Issues
 ~~~~~~~~~~~~
 
-- None.
+- According to RFC 8310, Section 8.1, the Subject field MUST NOT be
+  inspected when verifying a remote certificate while establishing a
+  DNS-over-TLS connection. Only SubjectAltName must be checked
+  instead. Unfortunately, some quite old versions of cryptographic
+  libraries might lack the functionality to ignore the Subject
+  field. It should have minimal production use consequences, as most
+  of the production-ready certificates issued by certificate
+  authorities will have SubjectAltNames set. In such a case, the
+  Subject field is ignored. Only old platforms are affected by this,
+  e.g., those supplied with OpenSSL versions older than 1.1.1.
 
 New Features
 ~~~~~~~~~~~~