[TS-3608] SSL client code does not validate upstream hostname

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 6.0.0
• Component/s: SSL
• Labels: yahoo
• Assignee: Uri Shachar
• Reporter: Uri Shachar
• Created: 16/May/15 14:13
• Updated: 04/Feb/16 18:55
• Resolved: 16/May/15 14:24

Description

Our SSL client side certificate validation does not validate that the upstream certificate actually matches the request hostname/IP.

Openssl added a check for this (X509_check_host) in 1.0.2 – but that version is still far from becoming mainstream (and the implementation there is somewhat overcomplicated for our needs).

Fix is to validate (when client side validation is turned on) according to RFC6125