#51100 [Opn->Asn]: Patch for CN_match to support wildcards

ID: 51100 Updated by: pajoye@php.net Reported By: bostjan at a2o dot si -Status: Open +Status: Assigned Bug Type: Streams related Operating System: Linux (Slackware PHP Version: 5.2.12 -Assigned To: +Assigned To: pajoye New Comment: This feature is already implemented as far as I can tell, if it does not work, then let fix it. Previous Comments: ------------------------------------------------------------------------ [2010-02-20 19:27:11] bostjan at a2o dot si Description: ------------ Stream context option CN_match does not support wildcard CN matching on PHP side. It only supports matching if a client connecting to PHP presents itself with wildcard in CN or if PHP connects to server which presents itself with wildcard in CN. See my comment from 20Feb2010 here: http://www.php.net/manual/en/context.ssl.php Here is a link to a patch which enables "limited wildcard matching" if asterisk is present in CN_match. http://source.a2o.si/php/php-ext-openssl-CN_match-wildcard.diff Reproduce code: --------------- ####### SERVER // Create context and other stuff ... // Set relevant option stream_context_set_option($ctx, 'ssl', 'CN_match', '*.example.org'); // Create the server socket $server = stream_socket_server('ssl://0.0.0.0:9001', $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $ctx); ####### COMMAND LINE CLIENT $ openssl s_client -host localhost -port 9001 -cert host.example.org.cert Expected result: ---------------- Successfull connection Actual result: -------------- Connection is closed with following warning message: Warning: stream_socket_accept(): Peer certificate CN=`host.example.org' did not match expected CN=`*.example.org' in... ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=51100&edit=1