Worked on the golang/go repository to address a security-critical issue in certificate validation, focusing on IP name constraint normalization. Using Go and leveraging backend development and networking expertise, implemented logic to normalize host bits in IP constraints, resolving false negatives in the constraint matcher and maintaining invariants across constraint sets. This update ensures that TLS validation correctly enforces both permitted and excluded IP ranges, aligning with RFC 5280 requirements. The work involved peer review and automated testing, ultimately strengthening the security posture by preventing acceptance of certificates that should be rejected due to improperly matched IP constraints during validation.