[#70843] Re: [ruby-cvs:58952] hsbt:r51801 (trunk): * lib/rubygems: Update to RubyGems HEAD(fe61e4c112). — Eric Wong <normalperson@...>
hsbt@ruby-lang.org wrote:
3 messages
2015/09/17
[ruby-core:70794] [Ruby trunk - Bug #6493] OpenSSL::SSL ignores DN if subjectAltName is specified
From:
zzak@...
Date:
2015-09-13 03:32:26 UTC
List:
ruby-core #70794
Issue #6493 has been updated by Zachary Scott.
Assignee changed from Martin Bosslet to openssl
----------------------------------------
Bug #6493: OpenSSL::SSL ignores DN if subjectAltName is specified
https://bugs.ruby-lang.org/issues/6493#change-54178
* Author: Dustin Mitchell
* Status: Feedback
* Priority: Normal
* Assignee: openssl
* ruby -v: trunk
* Backport:
----------------------------------------
In ext/openssl/lib/openssl/ssl.rb, verify_certificate_identity seems to intentionally *not* check the DN if any subjectAltName extensions are found.
RFC3280 says
<pre>
The subject alternative names extension allows additional identities
to be bound to the subject of the certificate. ...
</pre>
which suggests that it contains *additional* identities, and thus does not exclude the subject.
This functionality was added way back in 2005, r7970:
* ext/openssl/lib/openssl/ssl.rb
(OpenSSL::SSL::SSLSocket#post_connection_check): new method.
and moved around several times since then.
--
https://bugs.ruby-lang.org/