hyc(a)OpenLDAP.org wrote: Fyi, tls_g.c (GnuTLS support) already does this correctly. A quick browse thru my Mozilla source tree shows that MozNSS does this check incorrectly. I will probably have to write an equivalent chkhost function for tls_m.c and disable their default verifier. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/