wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-11-13 17:00:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3775 from cesanta/nocnfb

Browse Source 
do not fallback to CN after SAN
This commit is contained in:
Sergio R. Caprile authored and GitHub committed 2026-11-12 13:59:16 -03:00
2 parents c835c72202 454bf4036f
commit 94ccc4a130
2 files changed
+2 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+1 -1
View File
@@ -20305,7 +20305,7 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
bool is_addr = mg_aton_(mg_str_s(tls->hostname), &addr);
if (mg_tls_verify_cert_san(cert, certsz, tls->hostname,
is_addr ? &addr : NULL) <= 0 &&
(!is_addr || // DNS CN fallback
(is_addr || // IP references require a matching SAN
mg_tls_verify_cert_cn(&ci->subj, tls->hostname) <= 0)) {
mg_error(c, "failed to verify hostname");
return -1;
src/tls_builtin.c
+1 -1
View File
@@ -1904,7 +1904,7 @@ static int mg_tls_recv_cert(struct mg_connection *c, bool is_client) {
bool is_addr = mg_aton_(mg_str_s(tls->hostname), &addr);
if (mg_tls_verify_cert_san(cert, certsz, tls->hostname,
is_addr ? &addr : NULL) <= 0 &&
(!is_addr || // DNS CN fallback
(is_addr || // IP references require a matching SAN
mg_tls_verify_cert_cn(&ci->subj, tls->hostname) <= 0)) {
mg_error(c, "failed to verify hostname");
return -1;