From darshankmistry@yahoo.com Fri May 10 20:32:34 2019 From: darshankmistry@yahoo.com To: openldap-bugs@openldap.org Subject: Re: (ITS#9021) TLS: can't connect: TLS: hostname does not match CN in peer certificate Date: Fri, 10 May 2019 20:32:32 +0000 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============8956156778888380881==" --===============8956156778888380881== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit ------=_Part_545863_1662769086.1557520342175 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable thank you very much for quick response and openldap behavior configuration.= =C2=A0 how we can ignore to look server name in subject of certificate so I can us= e LDAP server ip address instead of host name?=C2=A0 Also want to know if there is any open CVE which says it is vulnerabilities= to use LDAP server ip address instead of name in ldap configuration.=C2=A0 Thank you, Darshankumar Mistry darshankmistry(a)yahoo.com =20 On Friday, May 10, 2019, 12:58:38 PM PDT, Quanah Gibson-Mount wrote: =20 =20 --On Friday, May 10, 2019 8:52 PM +0000 darshankmistry(a)yahoo.com wrote: > Full_Name: Darshankumar Mistry > Version: > OS: > URL: ftp://ftp.openldap.org/incoming/ > Submission from: (NULL) (2001:420:10b:1272:fc1b:1ea:d311:6cac) > > > I would like to know why Open LDAP behavior was changed where we must > have to configure FQDN name mentioned in certificate in order to work LDA= P > authentication... else TLS start failing. OpenLDAP has worked this way since I first started using it in 2002.=C2=A0 = This=20 behavior is nothing new.=C2=A0 And this is the correct behavior. This ITS will be closed. --Quanah -- Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: =20 ------=_Part_545863_1662769086.1557520342175 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
t= hank you very much for quick response and openldap behavior configuration.&= nbsp;

how we can ignore to look server name in sub= ject of certificate so I can use LDAP server ip address instead of host nam= e? 

Also want to know if there is any open CV= E which says it is vulnerabilities to use LDAP server ip address instead of= name in ldap configuration. 


=
Thank you,
Darshankumar Mistry
darshankmistry(a)yahoo.com


=20
------=_Part_545863_1662769086.1557520342175-- --===============8956156778888380881==--