Re: StartTLS with a host alias

Hallvard B Furuseth wrote:

Howard Chu writes:

...

Well, there can be any number of CNs in a DN. But only the most-inferior RDN actually names the certificate, therefore that's the only one that may be used in hostname checking.

Then something (OpenSSL?) is broken. The hostname which succeeded is in the topmost of his RDNs which has a CN, not in the most inferior RDN.

Hm, good point. The OpenSSL function used in libldap/tls.c doesn't have an argument to specify which CN to return. That code may need to be rewritten.