Timeline for WinHTTP and python requests package, fail to validate certificate containing valid CN but invalid SAN
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 12, 2018 at 11:34 | comment | added | Steffen Ullrich | @MuhammadUzairKhan: it is not clear why it should parse URI SAN's since the process of certificate validation only involves DNS SAN and maybe IP SAN. But now I see that you've actually used a URI-SAN in your certificate and not IP or DNS SAN. | |
| Mar 12, 2018 at 11:25 | comment | added | Muhammad Uzair Khan | Just so anyone needs to know. Python requests does not parse URI SANs. | |
| Mar 9, 2018 at 6:00 | vote | accept | Muhammad Uzair Khan | ||
| Mar 1, 2018 at 8:45 | comment | added | Steffen Ullrich | @MuhammadUzairKhan: the only reference I have for this is the code you'll find on github. See github.com/python/cpython/blob/master/Lib/ssl.py#L276 | |
| Mar 1, 2018 at 7:32 | comment | added | Muhammad Uzair Khan | @steffan, can you provide reference to this: "The code here in the latest version of Python explicitly makes sure that CN is only checked if no SAN DNS names exist." | |
| Mar 1, 2018 at 7:31 | comment | added | Muhammad Uzair Khan | Im using python3.6 with requests==2.18.4 | |
| Feb 28, 2018 at 13:35 | comment | added | Kirill Sinitski | To add to Steffen's comment, there are also various RFC 5280 sections (e.g., Section 4.2.1.6) that specify SAN handling. More so, RFCs also specify that if only CN is used with server identity certificate, it must contain FQDN identifier and nothing else. SAN allows DNS-ID, SRV-ID, and URI-ID and is more flexible. | |
| Feb 27, 2018 at 18:40 | history | answered | Steffen Ullrich | CC BY-SA 3.0 |