Andreas Hasenack added the comment: At the least it should be made clear in the documentation that the hostname is not checked against the commonName nor the subjectAltName fields of the server certificate. And add some sample code to the documentation for doing a simple check. Something like this, to illustrate:
def get_subjectAltName(cert): if not cert.has_key('subjectAltName'): return [] ret = [] for rdn in cert['subjectAltName']: if rdn[0].lower() == 'dns' or rdn[0][:2].lower() == 'ip': ret.append(rdn[1]) return ret def get_commonName(cert): if not cert.has_key('subject'): return [] ret = [] for rdn in cert['subject']: if rdn[0][0].lower() == 'commonname': ret.append(rdn[0][1]) return ret def verify_hostname(cert, host): cn = get_commonName(cert) san = get_subjectAltName(cert) return (host in cn) or (host in san) __________________________________ Tracker <[EMAIL PROTECTED]> <http://bugs.python.org/issue1589> __________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com