Commit 5c87df10 authored by Joe Orton's avatar Joe Orton
Browse files

* modules/ssl/ssl_engine_init.c (ssl_check_public_cert): Fix spurious 

hostname-mismatch warning for valid wildcard certs.

PR: 37911
Submitted by: Nick Burch <nick torchbox.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@378487 13f79535-47bb-0310-9956-ffa450edef68
parent 64e3195f

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,9 @@ 
Changes with Apache 2.3.0

  [Remove entries to the current 2.0 and 2.2 section below, when backported]









  *) mod_ssl: Fix spurious hostname mismatch warning for valid









     wildcard certificates.  PR 37911.  [Nick Burch <nick torchbox.com>]

















  *) mod_proxy: Fix KeepAlives not being allowed and set to









     backend servers. PR 38602. [Ruediger Pluem, Jim Jagielski]










































modules/ssl/ssl_engine_init.c



+6
−6



























Changes for modules/ssl/ssl_engine_init.c: 6 added lines, 6 removed lines.



Original line number
Diff line number
Diff line







@@ -856,15 +856,15 @@ static void ssl_check_public_cert(server_rec *s,







    if (SSL_X509_getCN(ptemp, cert, &cn)) {









        int fnm_flags = APR_FNM_PERIOD|APR_FNM_CASE_BLIND;



















        if (apr_fnmatch_test(cn) &&









            (apr_fnmatch(cn, s->server_hostname,









                         fnm_flags) == APR_FNM_NOMATCH))









        {









        if (apr_fnmatch_test(cn)) {









            if (apr_fnmatch(cn, s->server_hostname,









                            fnm_flags) == APR_FNM_NOMATCH) {









                ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,









                         "%s server certificate wildcard CommonName (CN) `%s' "









                         "does NOT match server name!?",









                             "%s server certificate wildcard CommonName "









                             "(CN) `%s' does NOT match server name!?",









                             ssl_asn1_keystr(type), cn);









            }









        }









        else if (strNE(s->server_hostname, cn)) {









            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,









                         "%s server certificate CommonName (CN) `%s' "