-
Type: Improvement
-
Resolution: Fixed
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Minor Change
Prior to OpenSSL 1.0.2, hostnames were not verified when initiating a TLS connection. Because of this, whether or not the driver defaults to verifying hostnames is dependent on the version of OpenSSL the user has installed. To ensure consistent behavior, we should create client option (and map "tlsAllowInvalidHostnames" in the URI to this option) to allow invalid hostnames and then always pass an option to OpenSSL signifying whether to verify hostnames. The logic for determining whether hostnames should be verified is the following:
tlsAllowInvalidHostnames | tlsInsecure | option passed to OpenSSL |
unspecified | unspecified | verify hostnames |
unspecified | false | verify hostnames |
unspecified | true | do not verify hostnames |
false | * | verify hostnames |
true | * | do not verify hostnames |