search

forderud / WindowsClientAuth

Windows examples of certificates for client authentication in web and TLS socket scenarios
MIT License
3 stars 0 forks source link

TEST: Remove subjectAltName from server certificate #8

Closed forderud closed 2 years ago

forderud commented 2 years ago

This seem to trigger a "Not secure" warning when testing from Microsoft Edge with a NET::ERR_CERT_COMMON_NAME_INVALID error code. image

forderud commented 2 years ago

@jogerh Is this consistent with your findings?

jogerh commented 2 years ago

In my findings, I was using accessing the web server programmatically using the Windows Internet APIs. In my tests, the INTERNET_FLAG_IGNORE_CERT_CN_INVALID flag had been enabled when calling the HttpOpenRequest function, which silently ignored the missing Alternative Subject Name.