From fe2ddab0470e0189f06df51a70a5e1ac8d94322a Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 29 Aug 2017 10:56:40 +0100
Subject: [PATCH] Remove checks for consistent certificate alternative names

This was needed circa 2013 to guard against a curl-based issue in
the Shibboleth SP. This can no longer affect us because we no
longer use the PKIX trust model.
---
 mdx/uk/beans.xml | 2 --
 mdx/uk/verbs.xml | 2 --
 2 files changed, 4 deletions(-)

diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index 22b88e63..26c0166d 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -306,8 +306,6 @@
                                 p:warningBoundary="0" p:errorBoundary="2048"/>
                             <!-- Error on small RSA public exponents. -->
                             <bean parent="mda.X509RSAExponentValidator"/>
-                            <!-- Error on inconsistent subjectAltNames. -->
-                            <bean parent="ukf.X509ConsistentNameValidator"/>
 
                             <!--
                                 Debian weak key blacklists.
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index cfed773c..288b1fb7 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -314,8 +314,6 @@
                                 p:warningBoundary="0" p:errorBoundary="2048"/>
                             <!-- Error on small RSA public exponents. -->
                             <bean parent="mda.X509RSAExponentValidator"/>
-                            <!-- Error on inconsistent subjectAltNames. -->
-                            <bean parent="ukf.X509ConsistentNameValidator"/>
 
                             <!--
                                 Debian weak key blacklists.