Home GnuPG

Implement wildcards for hostname checking.

Description

Implement wildcards for hostname checking.

* src/x509.c (count_labels): New.
(check_hostname): Implement wildcards.

We support wildcards in the CN and subjectAltNames. The wildcard
must be the first label and macthes only one label.

*.org             - bad
*.example.org     - good
*.foo.example.org - good
*x.example.org    - bad
foo.*.example.org - bad
*.foo.example.org - good

The name *.example.org mactes for example

example.org
www.example.org
ftp.example.org

but not for example

ftp.foo.example.org

In general wildcard certifcates are a bad idea and should be avoided.

  • Signed-off-by: Werner Koch <wk@gnupg.org>

Details

Provenance
wernerAuthored on Feb 20 2017, 8:37 PM
Parents
rTcd1bbb318217: ntbtls-cli: New option --head and use a default SNI.
Branches
Unknown
Tags
Unknown