Repository navigation
httpclient: a certificate for ww*.example.com fails verification for www.example.com instead of matching it - #356
Merged
Conversation
…ww.example.com instead of matching it SSL_set1_host ran with OpenSSL's default host flags, which let a partial wildcard match: a certificate for 'ww*.example.com' authenticated 'www.example.com'. The client now sets X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS on each SSL after SSL_set1_host, as curl does; SslStream and Python refuse partial wildcards outright. A full wildcard ('*.example.com') still matches one label, and still not two. The pending test "tls client: a partial wildcard must not match (ww*.example.com is not www.example.com)" is now a Test.
This was referenced Oct 12, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #342.
The TLS client accepted a certificate for
ww*.example.comwhen connecting towww.example.com.SSL_set1_hostran with OpenSSL's default host flags, and those let a partial wildcard match.ConfigureNamesnow callsSSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)right afterSSL_set1_host. curl sets the same flag, and SslStream and Python refuse partial wildcards outright. It is one call per connection, on the SSL the name is set on. WithVerifyCertificate = falseno name is set, so the flag has nothing to act on. Nothing else changes: a full wildcard (*.example.com) still matches one label, and still not two.Proof
The pending test
tls client: a partial wildcard must not match (ww*.example.com is not www.example.com)is now aTest().src/change revertedFAIL ... a partial wildcard should not have authenticated www.example.com, got: 200|verified- 83 passed, 1 failed, 3 pendingPASS- 84 passed, 0 failed, 3 pendingIts two controls,
control - a full wildcard matches one label below itanda wildcard does not match across a label, pass both ways. The 3 pending are #343, #340 and #344's tests, as on main (main: 83 passed, 4 pending).With its siblings
This batch is #356 (#342), #358 (#343), #366 (#344) and #370 (#340). They merge with each other without conflicts, checked pairwise and all four together. #358 and #366 both edit
RunHandshakeAsync, in separate hunks. With all four merged, the Http suite is 88 passed, 0 failed, 0 pending.