On Thu, 19 Apr 2012, Paul Bakker wrote:
This seems to be a 'HTTP over TLS'-specific error.
I'm not an TLS/x509 expert but I don't think so. Also, you'll see that for
example GnuTLS agrees with my view here and this is how we do it for OpenSSL
(for all TLS-using protocols). I haven't checked how the other libs like
cyassl or axtls think of this.
Are you saying someone actually wants PolarSSL to work the way it works now?
In RFC 2818 (HTTP over TLS) it is stated that this behaviour is as such. RFC
5280, governing the generic X509 handling, does not state this behaviour and
desribes that the CN is still a valid name to check. The SSL/TLS guidelines
themselves do not discuss this handling any further.
But there may be another RFC that governs this that I have missed. Can
anybody else confirm or counter that this is HTTP over TLS specific and not
SSL/TLS generic?
RFC 6125 is quite specific in section 6.3:
Security Warning: A client MUST NOT seek a match for a reference
identifier of CN-ID if the presented identifiers include a DNS-ID,
SRV-ID, URI-ID, or any application-specific identifier types
supported by the client.
(DNS-ID being the name used there for Subject Alternative Name)
--
/ daniel.haxx.se
-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
