On 19-4-2012 15:42, Daniel Stenberg wrote: > I'm not an TLS/x509 expert but I don't think so. Also, you'll see that > for example GnuTLS agrees with my view here and this is how we do it > for OpenSSL (for all TLS-using protocols). I haven't checked how the > other libs like cyassl or axtls think of this. > > Are you saying someone actually wants PolarSSL to work the way it > works now? No not specifically, but never heard issues before either. > RFC 6125 is quite specific in section 6.3: > > Security Warning: A client MUST NOT seek a match for a reference > identifier of CN-ID if the presented identifiers include a DNS-ID, > SRV-ID, URI-ID, or any application-specific identifier types > supported by the client. > > (DNS-ID being the name used there for Subject Alternative Name) > Thanks a lot. That is the RFC that I missed apparently. I'll fix the behavior in the upcoming release.
Best regards, Paul Bakker ------------------------------------------------------------------- List admin: http://cool.haxx.se/list/listinfo/curl-library Etiquette: http://curl.haxx.se/mail/etiquette.html
