Options de contexte FTP
CN_match works contrary to intuitive thinking. I came across this when I was developing SSL server implemented in PHP. I stated (in code):
- do not allow self signed certs (works)
- verify peer certs against CA cert (works)
- verify the client's CN against CN_match (does not work), like this:
stream_context_set_option($context, 'ssl', 'CN_match', '*.example.org');
I presumed this would match any client with CN below .example.org domain.
Unfortunately this is NOT the case. The option above does not do that.
What it really does is this:
- it takes client's CN and compares it to CN_match
- IF CLIENT's CN CONTAINS AN ASTERISK like *.example.org, then it is matched against CN_match in wildcard matching fashion
Examples to illustrate behaviour:
(CNM = server's CN_match)
(CCN = client's CN)
- CNM=host.example.org, CCN=host.example.org ---> OK
- CNM=host.example.org, CCN=*.example.org ---> OK
- CNM=.example.org, CCN=*.example.org ---> OK
- CNM=example.org, CCN=*.example.org ---> ERROR
- CNM=*.example.org, CCN=host.example.org ---> ERROR
- CNM=*.example.org, CCN=*.example.org ---> OK
According to PHP sources I believe that the same applies if you are trying to act as Client and the server contains a wildcard certificate. If you set CN_match to myserver.example.org and server presents itself with *.example.org, the connection is allowed.
Everything above applies to PHP version 5.2.12.
I will supply a patch to support CN_match starting with asterisk.
Options de contexte SSL
Options de contexte SSL — Liste des options de contexte SSL
Description
Options de contexte pour les protocoles ssl:// et tls://.
Historique
| Version | Description |
|---|---|
| 5.3.2 |
Ajout de SNI_enabled et de
SNI_server_name.
|
| 5.0.0 |
Ajout des paramètres capture_peer_cert,
capture_peer_chain et
ciphers.
|
Notes
Note: Vu que ssl:// est un protocole sous-jacent pour les gestionnaires https:// et ftps://, toutes les options de contexte appliquées à ssl:// seront également appliquées à https:// et ftps://.
Note: Afin que SNI (Server Name Indication) soit disponible, PHP doit être compilé avec OpenSSL 0.9.8j ou supérieur. Utilisez la constante
OPENSSL_TLSEXT_SERVER_NAMEpour déterminer si SNI est supporté ou non.
add a note
User Contributed Notes
Options de contexte SSL - [1 notes]
Botjan kufca ¶
3 years ago