note 96328 added to context.ssl

CN_match works contrary to intuitive thinking. I came across this when I was developing SSL server implemented in PHP. I stated (in code): - do not allow self signed certs (works) - verify peer certs against CA cert (works) - verify the client's CN against CN_match (does not work), like this: stream_context_set_option($context, 'ssl', 'CN_match', '*.example.org'); I presumed this would match any client with CN below .example.org domain. Unfortunately this is NOT the case. The option above does not do that. What it really does is this: - it takes client's CN and compares it to CN_match - IF CLIENT's CN CONTAINS AN ASTERISK like *.example.org, then it is matched against CN_match in wildcard matching fashion Examples to illustrate behaviour: (CNM = server's CN_match) (CCN = client's CN) - CNM=host.example.org, CCN=host.example.org ---> OK - CNM=host.example.org, CCN=*.example.org ---> OK - CNM=.example.org, CCN=*.example.org ---> OK - CNM=example.org, CCN=*.example.org ---> ERROR - CNM=*.example.org, CCN=host.example.org ---> ERROR - CNM=*.example.org, CCN=*.example.org ---> OK According to PHP sources I believe that the same applies if you are trying to act as Client and the server contains a wildcard certificate. If you set CN_match to myserver.example.org and server presents itself with *.example.org, the connection is allowed. Everything above applies to PHP version 5.2.12. I will supply a patch to support CN_match starting with asterisk. ---- Server IP: 193.9.21.50 Probable Submitter: 213.143.85.229 ---- Manual Page -- http://www.php.net/manual/en/context.ssl.php Edit -- https://master.php.net/note/edit/96328 Del: integrated -- https://master.php.net/note/delete/96328/integrated Del: useless -- https://master.php.net/note/delete/96328/useless Del: bad code -- https://master.php.net/note/delete/96328/bad+code Del: spam -- https://master.php.net/note/delete/96328/spam Del: non-english -- https://master.php.net/note/delete/96328/non-english Del: in docs -- https://master.php.net/note/delete/96328/in+docs Del: other reasons-- https://master.php.net/note/delete/96328 Reject -- https://master.php.net/note/reject/96328 Search -- https://master.php.net/manage/user-notes.php