<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 7/23/15 2:20 AM, Brent Putman wrote:<br>
</div>
<blockquote cite="mid:55B08792.8080208@georgetown.edu" type="cite">
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
<br>
<div class="moz-cite-prefix">On 7/23/15 12:26 AM, Takeshi
NISHIMURA wrote:<br>
</div>
<blockquote cite="mid:55B06CE4.6040406@nii.ac.jp" type="cite">I
think you should not rely on sslSession.getPeerHost() returning
original hostnames.</blockquote>
<br>
Well, hindsight is 20/20. But I think I modeled that code on
something "official" at the time, although I don't remember what.
And I'd note that that's exactly what they do in their own
X509TrustMangerImpl [1] for the new endpoint identification stuff
that I earlier mentioned: <br>
</blockquote>
<br>
In addition to OpenJDK X509TrustManagerImpl, googling around it
seems that lots of JSSE examples on the internet use
SSLSession#getPeerHost(), rightly or wrongly.<br>
<br>
Closer to home, @Daniel: I noticed that both vt-ldap and ldaptive
are using this as well to get the hostname for verification:<br>
<br>
vt-ldap: edu.vt.middleware.ldap.ssl.AbstractTLSSocketFactory<br>
<br>
ldaptive: org.ldaptive.ssl.AbstractTLSSocketFactory,
org.ldaptive.ssl.HostnameVerifyingListener<br>
<br>
I have not actually tested them, so don't know if they trip this new
behavior or not.<br>
<br>
</body>
</html>