Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:69225
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.49 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <523A987B.3040506@rotorised.com>
References: <CAH8MpnnTGD0xAwG1j9sh10EC6XzdscVRLbJzEMG6qWSBK5c17w@mail.gmail.com>
	<523A466C.4070903@gmail.com>
	<CAHMUw2HxcWgOBxiK=r4y6FgWF_Gkhgc6BgHxF_bgLLJG9RVxmQ@mail.gmail.com>
	<CAH8MpnkHQhyZtxzMJni3ADNFoZo26KuDvXgTtYRD9EVS1TfvTA@mail.gmail.com>
	<523A987B.3040506@rotorised.com>
Date: Thu, 19 Sep 2013 02:49:09 -0400
Message-ID: <CAH8MpnkWTrqe9EUwb0z=e7Aj_Nbf-OeGDOi9-+6+xOK+4uxKBQ@mail.gmail.com>
To: Ryan McCue <lists@rotorised.com>
Cc: Tjerk Anne Meesters <datibbaw@php.net>, =?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?= <keisial@gmail.com>, 
	johannes@schlueters.dot.de, addw@phcomp.dot.co.uk, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e016354b670ebee04e6b6f379
Subject: Re: [PHP-DEV] Re: Re: PHP Crypt functions - security audit
From: rdlowrey@gmail.com (Daniel Lowrey)

--089e016354b670ebee04e6b6f379
Content-Type: text/plain; charset=ISO-8859-1

> To be clear, I *don't* mean SNI, I mean subjectAltName (SAN) validation.

Ah, apologies for the SNI/SAN confusion. However, I still cannot reproduce
this failure when verifying peers with certs utilizing the SAN extension. Could
you supply a code snippet demonstrating this failure?


On Thu, Sep 19, 2013 at 2:23 AM, Ryan McCue <lists@rotorised.com> wrote:

> Daniel Lowrey wrote:
> > This is incorrect. PHP has supported both the "SNI_enabled" and
> > "SNI_server_name"
> > SSL context options since 5.3. Anything older than 5.3 is not remotely
> > worth worrying over. You can verify this for yourself using the following
> > code:
>
> To be clear, I *don't* mean SNI, I mean subjectAltName (SAN) validation.
>
> The common name field (CN) contains the domain name for normal
> certificates, but you can have more than one domain per certificate. If
> you do that, it's stored in the subjectAltName (SAN) field. PHP only
> parses the CN, not the SAN, so any domain that isn't the main domain in
> the CN will fail.
>
> As per RFC 2818 (http://tools.ietf.org/html/rfc2818#section-3.1):
>
> > If a subjectAltName extension of type dNSName is present, that MUST
> > be used as the identity. Otherwise, the (most specific) Common Name
> > field in the Subject field of the certificate MUST be used. Although
> > the use of the Common Name is existing practice, it is deprecated and
> > Certification Authorities are encouraged to use the dNSName instead.
>
>
> --
> Ryan McCue
> <http://ryanmccue.info/>
>

--089e016354b670ebee04e6b6f379--