Commit c020ac8daf for bind

commit c020ac8daf44d17ff9a7dc75067739a86871afa0
Merge: 39bfe5898d b2cf464f41
Author: Michal Nowak <mnowak@isc.org>
Date:   Fri Oct 16 14:15:26 2026 +0200

    chg: dev: dig +https now requires a SubjectAltName in the server certificate

    When verifying a DNS-over-HTTPS server's hostname, "dig +https" accepted
    a certificate whose only name was in the Subject Common Name, while
    "dig +tls" already required a SubjectAltName. Current TLS standards
    have retired the Common Name, and OpenSSL 4.1 no longer consults it,
    so the same certificate was accepted or rejected depending on the
    OpenSSL version. Both transports now match the hostname against the
    SubjectAltName only, so a DoH server certificate without one is
    rejected with a peer verification failure. named is not affected, as
    its outgoing TLS connections already enforced this.

    Merge branch 'mnowak/dig-https-require-san' into 'main'

    See merge request isc-projects/bind9!12942