mirleft / ocaml-x509

X509 (RFC5280) handling in OCaml
BSD 2-Clause "Simplified" License
52 stars 34 forks source link

Provide X509.Certificate.ips / support_ips, and in validation #152

Closed hannesm closed 3 years ago

hannesm commented 3 years ago

A certificate may contain IP addresses in the SubjectAlternativeName extension. We are now able to verify this, alternatively to the hostname verification. This is especially useful for DNS-over-TLS where hostnames are not known (of the resolver), but the IP addresses are listed in the certificate.

The API change is minimal (in Authenticator.chain_of_trust) to avoid API breakage in all users.