<div class="gmail_quote">On Wed, Feb 29, 2012 at 9:40 AM, Halm Reusser <span dir="ltr"><<a href="mailto:halm.reusser@switch.ch">halm.reusser@switch.ch</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 29.02.12 14:51, Peter Schwindt wrote:<br>
> I checked with a handful of SSL tools and all I found out was, that<br>
</div>> upper mentioned server does have i ts IP as the CN in the cert. So<br>
<div class="im">> that looks really ok for me.<br>
<br>
</div>Your problem could be that the IP isn't in the subjectAltName?<br>
<br>
<a href="http://code.google.com/p/vt-middleware/source/browse/vt-ldap/branches/vt-ldap-3/src/main/java/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.java?spec=svn2217&r=2217#137" target="_blank">http://code.google.com/p/vt-middleware/source/browse/vt-ldap/branches/vt-ldap-3/src/main/java/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.java?spec=svn2217&r=2217#137</a><br>
<br>
(sorry I didn't find any published java doc)<br>
<br>
Although this is RFC compliant, I guess a lot of deployers will struggle<br>
- especially if they used CNs/subjectAltNames in a mixed way.<br><font color="#888888"><br></font></blockquote><div><br></div><div>When hostname verification was requested as the default behavior for LDAPS we decided that the best course of action was an implementation similar to Sun's implementation for startTLS. Sun leveraged RFC 2818 section 3.1 and I tried to stay true to that. If you're having certificate problems the javadoc for the hostname verifier can be found here:</div>
<div><a href="http://vt-middleware.googlecode.com/svn/vt-ldap/javadoc/vt-ldap-3.3.5/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.html">http://vt-middleware.googlecode.com/svn/vt-ldap/javadoc/vt-ldap-3.3.5/edu/vt/middleware/ldap/ssl/DefaultHostnameVerifier.html</a></div>
<div>Debug logs will also be useful in diagnosing problems.</div><div><br></div><div>--Daniel Fisher</div><div> </div></div>