8000 Drop `CN-ID` (`Common Name`) validation per `RFC 9525` Service Identity in TLS · Issue #254 · kvspb/nginx-auth-ldap · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Drop CN-ID (Common Name) validation per RFC 9525 Service Identity in TLS #254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
jsoref opened this issue Dec 28, 2023 · 0 comments 7E94
Open

Drop CN-ID (Common Name) validation per RFC 9525 Service Identity in TLS #254

jsoref opened this issue Dec 28, 2023 · 0 comments

Comments

@jsoref
Copy link
Contributor
jsoref commented Dec 28, 2023

Appendix A. Changes from RFC 6125

The server identity can only be expressed in the subjectAltNames extension; it is no longer valid to use the commonName RDN, known as CN-ID in [VERIFY].

Honoring this RFC will fix the poor error message in:

nginx-auth-ldap/ngx_http_auth_ldap_module.c

Line 1356 in 83c059b

"does not match address (neither server's domain nor IP in certificate's CN or SAN)");

@jsoref jsoref changed the title Drop CN-ID (Common Name) validation per RFC 9525 **Service Identity in TLS** Drop CN-ID (Common Name) validation per RFC 9525 Service Identity in TLS Dec 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jsoref
0