3 ms·

The TLS certificate does explicitly say that it's valid for all of the names involved in the report: X509v3 Subject Alternative Name: DNS:

The TLS certificate does explicitly say that it's valid for all of the names involved in the report: X509v3 Subject Alternative Name: DNS:chess.samba.org, DNS:etc.samba.org, DNS:ipv6-only.samba.org, DNS:ipv6-test.samba.org, DNS:ipv6-without-ipv4.samba.org, DNS:jitterbug.samba.org, DNS:jupiter.samba.org, DNS:linux-cifs.samba.org, DNS:mta-sts.lists.samba.org, DNS:mta-sts.samba.org, DNS:n4.samba.org, DNS:netfilter.samba.org, DNS:news.samba.org, DNS:rproxy.samba.org, DNS:vger.samba.org It feels like odd behavior but logically it makes sense to trust the authenticated info from the SSL certificate. Personally to resolve all ambiguity I'd just use different certificates. Separation of concerns and all.

jsmith45 4y ago
But let's say I had two severs. One that hosts 1000 different subdomains, so I give it a wildcard cert, as 1000 SAN entries would be absurd. The second server hosts one subhuman, and has a specific cert for it. Would Firefox try to send a request for that seperate subhuman to my big wildcard server? That sounds very wrong! It is also possible that I had configured that wildcard server to host up some default site for unknown hostnames. Perhaps that default site exists to tell people how to report a problem if they see it, as with 1000 subdomains it would be very easily for there to be an accidental mismatch between the name in DNS and the name in the nginx config, especially if relevant automation has not been built up yet. I'd see that as an absolute bug, regardless of what the spec says (and the bug report does has some people disputing the spec allows doing this without checking DNS first). Although I suppose it is possible that Firefox won't do this for wildcards, but only for explicitly listed SAN names? Which is better but still quite odd seeming to me.
- xg15 4y ago
  > The second server hosts one subhuman, and has a specific cert for it. Would Firefox try to send a request for that seperate subhuman to my big wildcard server? That sounds very wrong! You might want to clear your autocorrect cache.
marcosdumay 4y ago
It's a problem if you decide to trust a certificate that isn't automatically trusted by the browser.

jsmith45 4y ago

But let's say I had two severs. One that hosts 1000 different subdomains, so I give it a wildcard cert, as 1000 SAN entries would be absurd. The second server hosts one subhuman, and has a specific cert for it. Would Firefox try to send a request for that seperate subhuman to my big wildcard server? That sounds very wrong! It is also possible that I had configured that wildcard server to host up some default site for unknown hostnames. Perhaps that default site exists to tell people how to report a problem if they see it, as with 1000 subdomains it would be very easily for there to be an accidental mismatch between the name in DNS and the name in the nginx config, especially if relevant automation has not been built up yet. I'd see that as an absolute bug, regardless of what the spec says (and the bug report does has some people disputing the spec allows doing this without checking DNS first). Although I suppose it is possible that Firefox won't do this for wildcards, but only for explicitly listed SAN names? Which is better but still quite odd seeming to me.

xg15 4y ago
> The second server hosts one subhuman, and has a specific cert for it. Would Firefox try to send a request for that seperate subhuman to my big wildcard server? That sounds very wrong! You might want to clear your autocorrect cache.

marcosdumay 4y ago

It's a problem if you decide to trust a certificate that isn't automatically trusted by the browser.