diff options
| author | David Ryskalczyk <d235j.1@gmail.com> | 2014-02-23 18:38:58 +0100 |
|---|---|---|
| committer | Marc Hoersken <info@marc-hoersken.de> | 2014-02-24 22:12:55 +0100 |
| commit | 63fc8ee7be2b712e7af5029f4f8a86a0dfd71b38 (patch) | |
| tree | 1539274155e5966b083fd122e507976add1c1a16 /lib/bundles.h | |
| parent | c27cc68815acd315c663e08ee9e3450b153f095f (diff) | |
winssl: Enable hostname verification of IP address using SAN or CN
Original commit message was:
Don't omit CN verification in SChannel when an IP address is used.
Side-effect of this change:
SChannel and CryptoAPI do not support the iPAddress subjectAltName
according to RFC 2818. If present, SChannel will first compare the
IP address to the dNSName subjectAltNames and then fallback to the
most specific Common Name in the Subject field of the certificate.
This means that after this change curl will not connect to SSL/TLS
hosts as long as the IP address is not specified in the SAN or CN
of the server certificate or the verifyhost option is disabled.
Diffstat (limited to 'lib/bundles.h')
0 files changed, 0 insertions, 0 deletions