Merge pull request 'Minor fix to how we verify hostnames' (#197) from tls-commonname-check into release2.3.3

Reviewed-on: #197
This commit is contained in:
Sloom Sloum Sluom IV 2020-11-06 03:28:31 +00:00
commit ebcd1ff1d7
1 changed files with 2 additions and 2 deletions

View File

@ -78,7 +78,7 @@ func (t *TofuDigest) Match(host, localCert string, cState *tls.ConnectionState)
return fmt.Errorf("EXP")
}
if err := cert.VerifyHostname(host); err != nil {
if err := cert.VerifyHostname(host); err != nil && cert.Subject.CommonName != host {
return fmt.Errorf("Certificate error: %s", err)
}
@ -107,7 +107,7 @@ func (t *TofuDigest) newCert(host string, cState *tls.ConnectionState) error {
continue
}
if err := cert.VerifyHostname(host); err != nil {
if err := cert.VerifyHostname(host); err != nil && cert.Subject.CommonName != host {
reasons.WriteString(fmt.Sprintf("Cert [%d] hostname does not match", index+1))
continue
}