Check against wrong domain

aeris / cryptcheck

Verify some SSL/TLS website or XMPP implementation

GNU Affero General Public License v3.0

185 stars 20 forks source link

Check against wrong domain #26

Open ThomasLeister opened 7 years ago

ThomasLeister commented 7 years ago

If I check my XMPP Server "trashserver.net" I get the "M" score, because "h-sirius..." does not match my TLS certificate for "trashserver.net". I'm not 100% sure, but I guess the test shouldn't check against the hostname in the right value part of my SRV record, but against the original domain for the XMPP service.

Web browsers don't check the certificates against the resolved hostname of a CNAME record either, but against the original domain.

Could you fix that?

lanodan commented 7 years ago

XMPP.net also uses "trashserver.net" in this case, but I don’t know about a standard for that.