Re: certificate warnings

[Philip Guenther <guenther+ldapsoft@sendmail.com>]

On Tue, 16 Mar 2010, Brett @Google wrote:
> Is there any way of supressing the SSL warning/error "TLS: hostname 
> (XXXXX) does not match common name in certificate" for a syncrepl 
> client?
> 
> This error is being returned by a syncrepl client which is negotiating 
> SSL talking to a syncrepl server by using it's (actual / real) server 
> name, but as the server name returns a certificate based on its 
> (external / content switch) server name, the ssl library on the client 
> waits for a randomly long time, and then returns the error above as the 
> cert returned does not exactly match the hostname configured in the 
> provider="" line, in the syncrepl client configuration.

Right answer: give (each) server a cert which has a subjectAltName 
extension that includes its real name.


> If it's indeed a warning, then the sycrepl client should ignore it, but 
> it does not, so effectively it is an error as it causes the syncrepl 
> client to abort it's connection.

I-Don't-Really-Care-About-Security Answer: set the tls_reqcert suboption 
on the syncrepl option to disable checking of connected to URL against the 
returned certificate's names.  Or, the better way to do that (but still 
insecure) is to configure it to use an anonymous cipher-suite, thereby 
saving a bunch of crypto during TLS handshakes.


Philip Guenther