Uploaded image for project: 'Core Server'
  1. Core Server
  2. SERVER-14861

SSL hostname matching does not strictly follow RFC 2818

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 2.7.7
    • Affects Version/s: None
    • Component/s: Security
    • None
    • ALL

      This came up in connection to SERVER-14516. If both a subject and subject alternative names exist the server will match against both. RFC 2818 requires the subject be ignored if subjectAltNames exist.

      From section 3.1 in http://tools.ietf.org/html/rfc2818.html:

      If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.

      The test certs created for SERVER-14516 will have to be regenerated to include 'server' as a subjectAltName.

            Assignee:
            amalia.hawkins@10gen.com Amalia Hawkins
            Reporter:
            bernie@mongodb.com Bernie Hackett
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: