On 11/28/2017 2:12 PM, Hemant Kumar via curl-library wrote:
> I am using pycurl (python wrapper of libcurl) to connect to a remote
> server(HTTPS) via a proxy(HTTPS). 
> While establishing SSL connection with the proxy, the certificate
> shared by proxy has both CN and SAN entries as below -
>
> Subject: C=IN, ST=KA, L=BGL, O=xxxx, OU=x, *CN=host.cust1.com <http://host.cust1.com>*/emailAddress=email@domain.com <mailto:email@domain.com>
> X509v3 Subject Alternative Name:
> DNS:host.cust1.com <http://host.cust1.com>, *DNS:172.73.74.75*, DNS:securepr.cust1.com <http://secureprofile.cust1.com>
> In my code when I use proxy's FQDN(host.cust1.com
> <http://host.cust1.com>) as the proxy URL to access then the ssl
> verification works fine but when I try using the IP Address I get
> below error -
>
> "SSL: no alternative certificate subject name matches target host name
> '172.73.74.75'"
>
> Should not libcurl verify the proxy URL against all the subject
> alternate names present in the received certificate or am I missing
> something here?
> Software versions used - PycURL/7.43.0 libcurl/7.56.1

In my opinion, no.

Is the PycURL string supposed to include the libcurl version string?
What SSL library is libcurl using? It should have shown you the SSL
library in the version information. I will assume OpenSSL for this reply.

libcurl w/ OpenSSL will only use iPAddress altname field for IP
addresses and dNSName altname field for host names [1]. There's some
anecdotal evidence of clients that accept IP address in dNSName [2]. I
believe those clients are wrong. The original RFC 2818 is unambiguous [3]:

   In some cases, the URI is specified as an IP address rather than a
   hostname. In this case, the iPAddress subjectAltName must be present
   in the certificate and must exactly match the IP in the URI.

[1]: https://github.com/curl/curl/blob/curl-7_56_1/lib/vtls/openssl.c#L1389
[2]: https://security.stackexchange.com/a/160809
[3]: https://tools.ietf.org/html/rfc2818#page-5

-------------------------------------------------------------------
Unsubscribe: https://cool.haxx.se/list/listinfo/curl-library
Etiquette: https://curl.haxx.se/mail/etiquette.html
Received on 2017-11-29