[HTTPCLIENT-613] https should check CN of x509 cert

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 4.0 Alpha 1
• Component/s: HttpClient (classic)
• Assignee: Unassigned
• Reporter: Julius Davies
• Created: 06/Dec/06 04:26
• Updated: 28/Jul/14 13:24
• Resolved: 08/Dec/06 16:05

Description

https should check CN of x509 cert

Since we're essentially rolling our own "HttpsURLConnection", the checking provided by "javax.net.ssl.HostnameVerifier" is no longer in place.

I have a patch I'm about to attach which caused both createSocket() methods on o.a.h.conn.ssl.SSLSocketFactory to blowup:

test1: javax.net.ssl.SSLException: hostname in certificate didn't match: <vancity.com> != <www.vancity.com>
test2: javax.net.ssl.SSLException: hostname in certificate didn't match: <vancity.com> != <www.vancity.com>

Hopefully people agree that this is desirable.