Details
-
Bug
-
Status: Resolved
-
Blocker
-
Resolution: Fixed
-
0.23.0, 0.23.1, 0.24.0, 0.24.1, 0.24.2, 0.25.0, 0.25.1, 0.26.0, 0.26.1, 0.27.0, 0.27.1, 0.27.2, 0.27.3, 0.28.0, 0.28.1, 0.28.2, 1.0.0
-
Mesosphere Sprint 38
Description
Our SSL certificate validation currently assumes that the host (on connect and on accept) does have a valid hostname. This however is not true for all environments.
process::network::openssl::verify currently only allows the validation of a certificate against a hostname.
See https://github.com/apache/mesos/blob/08866edd8a71d12f87f4f4dbefa292729efbf6ae/3rdparty/libprocess/src/openssl.cpp#L546
RFC2818 however says that it should be perfectly valid to validate a certificate based on the IP address.
See https://tools.ietf.org/html/rfc2818
In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.