RetroSearch Browse

Wed Jun 17 21:14:35 CEST 2009 · https://mail.python.org/pipermail/python-dev/2009-June/090108.html

Bill Janssen <janssen at parc.com> wrote:

> > Does it check that the host the socket is connected to is the same as
> > what's given in the CN field in the certificate?
> 
> No.  That, in general, doesn't work very well.  The IETF working group
> on this is considering deprecating putting a hostname in the CN field at
> all, and just adding hostnames via the subjectAltName extension.  The
> problem that's come up is that many computers don't have fixed IP
> addresses, and even with that the hostname is part of a different
> mapping of hostnames to IP addresses, which can also vary.

Incidentally, the current working draft on this seems to be at
<http://tools.ietf.org/html/draft-saintandre-tls-server-id-check-00>.

Bill

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://mail.python.org/pipermail/python-dev/2009-June/090108.html below:

[Python-Dev] SSL Certificate Validation