Issue with upgrading to 2.3.6

[Daniel Fisher]

On Wed, Feb 29, 2012 at 9:40 AM, Halm Reusser <halm.reusser at switch.ch>wrote:

> On 29.02.12 14:51, Peter Schwindt wrote:
> > I checked with a handful of SSL tools and all I found out was, that
> > upper mentioned server does have i ts IP as the CN in the cert. So
> > that looks really ok for me.
>
> Your problem could be that the IP isn't in the subjectAltName?
>
>
> http://code.google.com/p/vt-middleware/source/browse/vt-ldap/branches/vt-ldap-3/src/main/java/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.java?spec=svn2217&r=2217#137
>
> (sorry I didn't find any published java doc)
>
> Although this is RFC compliant, I guess a lot of deployers will struggle
> - especially if they used CNs/subjectAltNames in a mixed way.
>
>
When hostname verification was requested as the default behavior for LDAPS
we decided that the best course of action was an implementation similar to
Sun's implementation for startTLS. Sun leveraged RFC 2818 section 3.1 and I
tried to stay true to that. If you're having certificate problems the
javadoc for the hostname verifier can be found here:
http://vt-middleware.googlecode.com/svn/vt-ldap/javadoc/vt-ldap-3.3.5/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.html
Debug logs will also be useful in diagnosing problems.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120229/dd0bef6e/attachment.html