I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or subjectAltName) in the certificate match with the hostname brought along with the client. The relevant RFC 6125 says:
If the hostname does not match the identity in the certificate, user oriented clients MUST either notify the user (clients MAY give the user the opportunity to continue with the connection in any case) or terminate the connection with a bad certificate error. Automated clients MUST log the error to an appropriate audit log (if available) and SHOULD terminate the connection (with a bad certificate error). Automated clients MAY provide a configuration setting that disables this check, but MUST provide a setting which enables it.
For the reverse proxy scenario, is the server-side connection an "automated client" or a "user-oriented client"?