[Date Prev][Date Next]
Re: certificate warnings
On Tue, 16 Mar 2010, Brett @Google wrote:
> Is there any way of supressing the SSL warning/error "TLS: hostname
> (XXXXX) does not match common name in certificate" for a syncrepl
> This error is being returned by a syncrepl client which is negotiating
> SSL talking to a syncrepl server by using it's (actual / real) server
> name, but as the server name returns a certificate based on its
> (external / content switch) server name, the ssl library on the client
> waits for a randomly long time, and then returns the error above as the
> cert returned does not exactly match the hostname configured in the
> provider="" line, in the syncrepl client configuration.
Right answer: give (each) server a cert which has a subjectAltName
extension that includes its real name.
> If it's indeed a warning, then the sycrepl client should ignore it, but
> it does not, so effectively it is an error as it causes the syncrepl
> client to abort it's connection.
I-Don't-Really-Care-About-Security Answer: set the tls_reqcert suboption
on the syncrepl option to disable checking of connected to URL against the
returned certificate's names. Or, the better way to do that (but still
insecure) is to configure it to use an anonymous cipher-suite, thereby
saving a bunch of crypto during TLS handshakes.