Quanah Gibson-Mount wrote:
--On Wednesday, May 10, 2017 10:49 AM -0700 Ryan Tandy
> On Wed, May 10, 2017 at 09:32:59AM -0700, Quanah Gibson-Mount wrote:
>> RFC 6761 specifically notes that "localhost." is in fact a domain name
>> (Section 6.3). Therefore, my certificates are in fact correct, and
>> the OpenLDAP code check is indeed a bug.
> "localhost." is a perfectly valid FQDN (as is the relatively common
> "localhost.localdomain."), but from earlier in the thread I gathered your
> system's FQDN is actually "u16build." or
The FQDN of the system is immaterial. The point is to have a certificate
without *any* reference to the system hostname, and be entirely based on
localhost. The RFCs seem to indicate that is perfectly legitimate. It is the
OpenLDAP code check that breaks this ability.
Wrong. The FQDN of the system is the entire point of this discussion. Cert
verification is based first and primarily on hostnames.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/