Complete and correct support for directoryName constraints #19
Description
Just to record: this and the parent repo do not correctly process directoryName name constraints. The easier reproducer for this is (in rustls):
$ ./target/debug/tlsclient-mio --http www.indicepa.gov.it
TLS error: InvalidCertificateData("invalid peer certificate: UnknownIssuer")
The issuer here is https://crt.sh/?id=5715019745&opt=cablint,x509lint,zlint and we're incorrectly processing the constraint against the end-certificate subject. There seems to be a lack of code that dissects the subject into name attributes, and no code at all for comparing sets of DN attributes for equality?
golang has the same issue golang/go#55872