Red Hat Bugzilla – Bug 1080142
m2crypto does not support subject alternative name with IP address
Last modified: 2015-11-24 08:22:26 EST
Description of problem: When m2crypto client connects to a server specified only by IP address, the verification of certificate fails Version-Release number of selected component (if applicable): m2crypto-0.21.1-14.el7.x86_64 How reproducible: Always Steps to Reproduce: 1. Create a CA and sing certificate with SAN pointing to 127.0.0.1 2. Start s_server with the certificate 3. connect to local s_server using 127.0.0.1 as the hostname Actual results: LOOP: SSL connect: before/connect initialization LOOP: SSL connect: SSLv2/v3 write client hello A LOOP: SSL connect: SSLv3 read server hello A LOOP: SSL connect: SSLv3 read server certificate A LOOP: SSL connect: SSLv3 read server key exchange A LOOP: SSL connect: SSLv3 read server done A LOOP: SSL connect: SSLv3 write client key exchange A LOOP: SSL connect: SSLv3 write change cipher spec A LOOP: SSL connect: SSLv3 write finished A LOOP: SSL connect: SSLv3 flush data LOOP: SSL connect: SSLv3 read server session ticket A LOOP: SSL connect: SSLv3 read finished A INFO: SSL connect: SSL negotiation finished successfully Traceback (most recent call last): File "sni.py", line 48, in <module> s.connect((host, port)) File "/usr/lib64/python2.7/site-packages/M2Crypto/SSL/Connection.py", line 188, in connect if not check(self.get_peer_cert(), self.addr[0]): File "/usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.py", line 98, in __call__ fieldName='subjectAltName') M2Crypto.SSL.Checker.WrongHost: Peer certificate subjectAltName does not match host, expected 127.0.0.1, got DNS:wronghostname.com, DNS:example.com, DNS:evenmoreincorrectname.com, IP Address:127.0.0.1 ALERT: write: warning: close notify Expected results: Successful connection to server Additional info:
Thanks for the report. File upstream as well for reference.
(In reply to Miloslav Trmač from comment #1) > File upstream as well for reference. "Filed upstream", sorry.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-2165.html