Skip to content

Commit 1a95ce5

Browse files
tmuellerleileindutny
authored andcommitted
tls: Re-enable check of CN-ID in cert verification
RFC 6125 explicitly states that a client "MUST NOT seek a match for a reference identifier of CN-ID if the presented identifiers include a DNS-ID, SRV-ID, URI-ID, or any application-specific identifier types supported by the client", but it MAY do so if none of the mentioned identifier types (but others) are present.
1 parent 84bb0ec commit 1a95ce5

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

lib/tls.js

+2-2
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,6 @@ function checkServerIdentity(host, cert) {
128128
//
129129
// Walk through altnames and generate lists of those names
130130
if (cert.subjectaltname) {
131-
matchCN = false;
132131
cert.subjectaltname.split(/, /g).forEach(function(altname) {
133132
if (/^DNS:/.test(altname)) {
134133
dnsNames.push(altname.slice(4));
@@ -166,7 +165,8 @@ function checkServerIdentity(host, cert) {
166165

167166
if (dnsNames.length > 0) matchCN = false;
168167

169-
// Match against Common Name (CN) only if altnames are not present.
168+
// Match against Common Name (CN) only if no supported identifiers are
169+
// present.
170170
//
171171
// "As noted, a client MUST NOT seek a match for a reference identifier
172172
// of CN-ID if the presented identifiers include a DNS-ID, SRV-ID,

0 commit comments

Comments
 (0)