Bug #67666 [Opn->Csd]: Subject alternative name verification does not match wildcards

Edit report at https://bugs.php.net/bug.php?id=67666&edit=1 ID: 67666 Updated by: datibbaw@php.net Reported by: thijs at debian dot org Summary: Subject alternative name verification does not match wildcards -Status: Open +Status: Closed Type: Bug Package: OpenSSL related Operating System: Debian sid PHP Version: 5.6.0RC2 Block user comment: N Private report: N New Comment: Automatic comment on behalf of datibbaw Revision: http://git.php.net/?p=php-src.git;a=commit;h=38e714ece52f38963c072434b12174bccedcd1c7 Log: Fixed #67666 - Subject altName doesn't match wildcards Previous Comments: ------------------------------------------------------------------------ [2014-07-22 11:42:27] thijs at debian dot org Description: ------------ When fetching things from an https:// url with PHP (e.g. file_get_contents()), the hostname is matched against the names in the certificate's subject alternative names extension since PHP 5.6, good. However, it does not apply the wildcard matching that it does to common names to these names, therefore https requests to resources on a server that has a wildcard SAN fail. An example site that has such a certificate is https://raw.githubusercontent.com. The test script below reproduces the problem for me. Test script: --------------- <?php ini_set("display_errors", TRUE); $readme = file_get_contents('https://raw.githubusercontent.com/php/php-src/master/README.md'); echo $readme; Expected result: ---------------- Contents of README.md. Actual result: -------------- Warning: file_get_contents(): Peer certificate CN=www.github.com' did not match expected CN=raw.githubusercontent.com' in /srv/www/test.php on line 6 Warning: file_get_contents(): Failed to enable crypto in /srv/www/test.php on line 6 Warning: file_get_contents(https://raw.githubusercontent.com/php/php-src/master/README.md): failed to open stream: operation failed in /srv/www/test.php on line 6 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=67666&edit=1