PKI library: dNSName constraints starting with dot should match subdomains.

net/cert/internal/name_constraints.cc

Index: net/cert/internal/name_constraints.cc
diff --git a/net/cert/internal/name_constraints.cc b/net/cert/internal/name_constraints.cc
index 162569f964cfcdf0958b5f1d365cc42e042ba7fd..0ed685101e9a15d6463ed693188273aed304c5fa 100644
--- a/net/cert/internal/name_constraints.cc
+++ b/net/cert/internal/name_constraints.cc
@@ -87,6 +87,11 @@ bool DNSNameMatches(base::StringPiece name,
   // Exact match.
   if (name.size() == dns_constraint.size())
     return true;
+  // If dNSName constraint starts with a dot, only subdomains should match.
+  // (e.g., "foo.bar.com" matches constraint ".bar.com", but "bar.com" doesn't.)
+  // RFC 5280 is ambiguous, but this matches the behavior of other platforms.
+  if (!dns_constraint.empty() && dns_constraint[0] == '.')
+    dns_constraint.remove_prefix(1);
   // Subtree match.
   if (name.size() > dns_constraint.size() &&
       name[name.size() - dns_constraint.size() - 1] == '.') {