Bill Janssen <jans...@parc.com> wrote: > > Does it check that the host the socket is connected to is the same as > > what's given in the CN field in the certificate? > > No. That, in general, doesn't work very well. The IETF working group > on this is considering deprecating putting a hostname in the CN field at > all, and just adding hostnames via the subjectAltName extension. The > problem that's come up is that many computers don't have fixed IP > addresses, and even with that the hostname is part of a different > mapping of hostnames to IP addresses, which can also vary.
Incidentally, the current working draft on this seems to be at <http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-00>. Bill _______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
