httpd-bugs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From bugzi...@apache.org
Subject DO NOT REPLY [Bug 37911] New: - Incorrect warning "RSA server certificate CommonName (CN) `*.xxxxx.xxx' does NOT match server name!?"
Date Wed, 14 Dec 2005 18:35:48 GMT
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG·
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=37911>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND·
INSERTED IN THE BUG DATABASE.

http://issues.apache.org/bugzilla/show_bug.cgi?id=37911

           Summary: Incorrect warning "RSA server certificate CommonName
                    (CN) `*.xxxxx.xxx' does NOT match server name!?"
           Product: Apache httpd-2
           Version: 2.0.55
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: nick@torchbox.com


The logic for deciding if a warning about the certificate CN not matching the
server name is incorrect for the case of wilcard certificates. (It incorrectly
drops into the normal test for a valid wildcard certificate)

The fix is:

--- ssl_engine_init.c.sav       2005-12-09 16:36:21.000000000 +0000
+++ ssl_engine_init.c   2005-12-14 18:23:01.360818339 +0000
@@ -834,14 +836,16 @@
     if (SSL_X509_getCN(ptemp, cert, &cn)) {
         int fnm_flags = FNM_PERIOD|FNM_CASE_BLIND;
 
-        if (apr_fnmatch_test(cn) &&
-            (apr_fnmatch(cn, s->server_hostname,
-                         fnm_flags) == FNM_NOMATCH))
-        {
-            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
+        if (apr_fnmatch_test(cn))
+               {
+                       if (apr_fnmatch(cn, s->server_hostname,
+                         fnm_flags) == FNM_NOMATCH)
+                       {
+                               ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
                          "%s server certificate wildcard CommonName (CN) `%s' "
                          "does NOT match server name!?",
                          ssl_asn1_keystr(type), cn);
+                       }
         }
         else if (strNE(s->server_hostname, cn)) {
             ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,

-- 
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org


Mime
View raw message