Closed forderud closed 2 years ago
@jogerh Is this consistent with your findings?
In my findings, I was using accessing the web server programmatically using the Windows Internet APIs. In my tests, the INTERNET_FLAG_IGNORE_CERT_CN_INVALID flag had been enabled when calling the HttpOpenRequest function, which silently ignored the missing Alternative Subject Name.
This seem to trigger a "Not secure" warning when testing from Microsoft Edge with a NET::ERR_CERT_COMMON_NAME_INVALID error code.![image](https://user-images.githubusercontent.com/2671400/186242553-6307a04b-756b-48d6-a7b0-57ca11648283.png)