[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Bug in tlso_session_chkhost?

Quanah Gibson-Mount wrote:
--On Wednesday, May 10, 2017 10:49 AM -0700 Ryan Tandy <ryan@nardis.ca> wrote:

On Wed, May 10, 2017 at 09:32:59AM -0700, Quanah Gibson-Mount wrote:
RFC 6761 specifically notes that "localhost." is in fact a domain name
(Section 6.3).  Therefore, my certificates are in fact correct, and
the OpenLDAP code check is indeed a bug.

"localhost." is a perfectly valid FQDN (as is the relatively common
"localhost.localdomain."), but from earlier in the thread I gathered your
system's FQDN is actually "u16build." or "u16build.some.domain.".

The FQDN of the system is immaterial.  The point is to have a certificate
without *any* reference to the system hostname, and be entirely based on
localhost.  The RFCs seem to indicate that is perfectly legitimate.  It is the
OpenLDAP code check that breaks this ability.

Wrong. The FQDN of the system is the entire point of this discussion. Cert verification is based first and primarily on hostnames.

  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/