search

letoams / hash-slinger

GNU General Public License v2.0
50 stars 14 forks source link

Does not handle wildcards in certs? #9

Closed bortzmeyer closed 8 years ago

bortzmeyer commented 8 years ago

% tlsa --verify good.dane.verisignlabs.com WARNING: Name on the certificate (Subject: /C=US/ST=Virginia/L=Reston/O=Verisign, Inc./OU=Technology Services Group/CN=.dane.verisignlabs.com, SubjectAltName: DNS:.dane.verisignlabs.com) doesn't match requested hostname (good.dane.verisignlabs.com). Caution: name on the cert does not match hostname SUCCESS (usage 3): The certificate offered by the server matches the TLSA record WARNING: Name on the certificate (Subject: /C=US/ST=Virginia/L=Reston/O=Verisign, Inc./OU=Technology Services Group/CN=.dane.verisignlabs.com, SubjectAltName: DNS:.dane.verisignlabs.com) doesn't match requested hostname (good.dane.verisignlabs.com). Caution: name on the cert does not match hostname SUCCESS (usage 3): The certificate offered by the server matches the TLSA record

IMHO, the cert should match, because of the wildcard *.dane.verisignlabs.com

letoams commented 8 years ago

fixed in git and will be in 2.7 paul@bofh:~/git/hash-slinger (master)$ ./tlsa --verify good.dane.verisignlabs.com SUCCESS (usage 3): Certificate offered by the server matches the TLSA record (72.13.58.31) and -d shows the wildcard: The matched certificate has Subject: /C=US/ST=Virginia/L=Reston/O=Verisign, Inc./OU=Technology Services Group/CN=*.dane.verisignlabs.com