I don't think it makes sense to have a separate flag. What's the harm in looking at the CN if you don't find a match in the SAN?
/r$
--
Principal Security Engineer
Akamai Technology
Cambridge, MA
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [email protected]
Automated List Manager [email protected]
