mainGnuTLS - Support: sr #107619, Check hostname of certificate...

 
 

sr #107619: Check hostname of certificate failed with two subdomains in hostname

Submitter:  Sebastien Helleu <flashcode>
Submitted:  Tue 08 Mar 2011 12:23:23 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 08 Mar 2011 12:50:48 PM UTC, comment #1: 

RFC2818 defines what certificates should contain for HTTPS servers. Unless there is a similar document for IRC servers, I'd consider that applicable and see it as problem in the freenode certificate.

RFC2818 is pretty explicit on that:
Names may contain the wildcard character which is considered to match any single domain name component or component fragment. E.g., .a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.


You could however use your custom matching function.

regards,
--nmav

Anonymous
Tue 08 Mar 2011 12:23:23 PM UTC, original submission:  

Hi,
I'm WeeChat developer, an irc client, which uses gnutls to connect to irc servers.
When I connect to freenode using SSL, I receive this certificate:


subject `OU=Domain Control Validated,OU=Gandi Standard Wildcard SSL,CN=*.freenode.net', issuer `C=FR,O=GANDI SAS,CN=Gandi Standard SSL CA', RSA key ...


I call function "gnutls_x509_crt_check_hostname (cert, hostname)" to check hostname with certificate.

If I connect to chat.freenode.net, the hostname check is ok (*.freenode.net matches chat.freenode.net).
But if I connect to ipv6.chat.freenode.net, the hostname check failed because *.freenode.net does NOT match ipv6.chat.freenode.net (according to RFC2818 you are using in your function).

My question are:

  • is it a problem in freenode certificate?
  • is it ok to use rfc2818 in gnutls to check certificate hostname? shouldn't *.freenode.net match ipv6.chat.freenode.net ?


Last info, I'm using gnutls 2.10.5 (under debian sid).

Thank you for your help.

Sebastien Helleu <flashcode>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Updated the item)
  • -email is unavailable- added by flashcode (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-03-25 nmav Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code