bugGNU Wget - Bugs: bug #23934, Certificate checking rules not...


bug #23934: Certificate checking rules not conformant with RFC2818 (HTTP over TLS)

Submitted by:  None
Submitted on:  Fri 25 Jul 2008 12:35:37 PM UTC  
Category:  Program Logic Severity:  3 - Normal
Priority:  5 - Normal Status:  Duplicate
Privacy:  Public Assigned to:  None
Originator Name:  Stefan Winter Originator Email:  -email is unavailable-
Open/Closed:  Closed Release:  1.11.1
Operating System:  GNU/Linux Reproducibility:  Every Time
Fixed Release:  None Planned Release:  None
Regression:  None Work Required:  None
Patch Included:  None

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Wed 07 Oct 2009 07:40:42 PM UTC, comment #4: 

Because patch does not apply onto wget-1.12 I rebased it and addedd check for NULL character in alternative DNS names.

The check is performed as simple strlen(utf8_c_string) comparison with ASN1_SRING_length(), but it should be sufficient because:

  • DNS names should be ASCII only (according RFC)
  • If it's not true, the UTF-8 encoding makes the C string longer, what cancels equality too.

(file #18828)

Petr Pisar <petrp>
Wed 04 Feb 2009 05:15:19 PM UTC, comment #3: 

This patch implements complete subjectAltNames check with full respect to RFC 2818.

It doesn't fix reamaining problems with multiple commonNames. Accually I don't understand it. I will appreciate if somobody enlighten it to me.

It opens question whether HTTPS client is supposted to convert between IPv4-mapped IPv6 addresses and IPv4 addresses when validating them. This patch doesn't do the conversion.

Checking IP address against iPAddress subjectAltNames is not tested.

It passes test case described in this bug report.

(file #17403)

Petr Pisar <petrp>
Tue 03 Feb 2009 10:13:39 PM UTC, comment #2: 

Attached patch provides basic fix. It checks for dNSName subjectAltNames first. It doesn't decides according current URL hostname (i.e. connecting using IP address to certificate with dNSName failes).

The patch is still raw because I'm going to fix related issues (ipAddress etc.) in the future. It's diffed against version 1.11.4.

(file #17400)

Petr Pisar <petrp>
Fri 25 Jul 2008 04:22:04 PM UTC, comment #1: 
Micah Cowan <micahcowan>
Fri 25 Jul 2008 12:35:37 PM UTC, original submission:  


according to RFC2818 (May 2000), the Common Name of a certificate is to be ignored during certificate validation if one or more subjectAltName:DNS fields is present. In this case, the set of subjectAltName:DNS is to be used to validate the expected host name. Section 3.1:

"If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead."
All browsers I know honour this clause.

At the URL https://pki.edugain.org/edugainca/crl/cacrl.pem there is a certificate with a CN of www.edugain.org, but a subjectAltName:dNSName of pki.edugain.org. Certificate validation should succeed in this case, but fails with wget:

haldir:~ # wget https://pki.edugain.org/edugainca/crl/cacrl.pem -O edugainca.crl.pem
--14:24:16--  https://pki.edugain.org/edugainca/crl/cacrl.pem
           => `edugainca.crl.pem'
Resolving pki.edugain.org...
Connecting to pki.edugain.org||:443... connected.
ERROR: certificate common name `www.edugain.org' doesn't match requested host name `pki.edugain.org'.
To connect to pki.edugain.org insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.

To properly reproduce, the CyberTrust root CA and CyberTrust educational CA need to be in the browser store. You can get them from the CyberTrust website at




(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #18828:  wget-1.12-subjectAltNames.diff added by petrp (8KiB - text/plain - Rebase for wget-1.12 with added check for NULL attack in dNSName subjectAltNames)
file #17403:  wget-1.11.4-subjectAltNames.diff added by petrp (5KiB - text/plain - FIx for this bug. It obsoletes file #17400)
file #17400:  wget-1.11.4-dnsnames-2.diff added by petrp (4KiB - text/plain - Check for dNSName subjectAltNames)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by petrp (Updated the item)
  • -email is unavailable- added by micahcowan (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)



    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-10-07 petrp Attached File- => Added wget-1.12-subjectAltNames.diff, #18828
    2009-02-04 petrp Attached File- => Added wget-1.11.4-subjectAltNames.diff, #17403
    2009-02-03 petrp Attached File- => Added wget-1.11.4-dnsnames-2.diff, #17400
    2008-07-25 micahcowan StatusNone => Duplicate
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.7