3 ms·
SSL libraries seem to treat CNs as fully-qualified, even without the dot. Do we really want a global ssl PKI where non-fqdn CNs are allowed? If not, why shoul
by harshreality 14y ago
SSL libraries seem to treat CNs as fully-qualified, even without the dot. Do we really want a global ssl PKI where non-fqdn CNs are allowed? If not, why should anyone care about trailing dots for ssl cert validation purposes?
- AnthonyMouse 14y ago>Do we really want a global ssl PKI where non-fqdn CNs are allowed? It might not have been a bad idea to prohibit it twenty years ago, but at this point it seems unlikely because everybody expects the contrary. > If not, why should anyone care about trailing dots for ssl cert validation purposes? Because if the cert has the dot and the address the client is connecting to doesn't, you may not be connected to the right machine. If I was writing a piece of client software, what I would do sooner than just allowing them to be considered identical is to do a name lookup for "example.com." if that's what's in the cert presented by "example.com" and make sure the IP address is identical to the one for the "example.com" I'm connected to, and then be OK if they are and fail validation if they aren't.