On Tue, 16 Mar 2010, Brett @Google wrote:
Is there any way of supressing the SSL warning/error "TLS: hostname (XXXXX) does not match common name in certificate" for a syncrepl client?
This error is being returned by a syncrepl client which is negotiating SSL talking to a syncrepl server by using it's (actual / real) server name, but as the server name returns a certificate based on its (external / content switch) server name, the ssl library on the client waits for a randomly long time, and then returns the error above as the cert returned does not exactly match the hostname configured in the provider="" line, in the syncrepl client configuration.
Right answer: give (each) server a cert which has a subjectAltName extension that includes its real name.
If it's indeed a warning, then the sycrepl client should ignore it, but it does not, so effectively it is an error as it causes the syncrepl client to abort it's connection.
I-Don't-Really-Care-About-Security Answer: set the tls_reqcert suboption on the syncrepl option to disable checking of connected to URL against the returned certificate's names. Or, the better way to do that (but still insecure) is to configure it to use an anonymous cipher-suite, thereby saving a bunch of crypto during TLS handshakes.
Philip Guenther