1

The question is actually about what level of validations browser does when it gets certificates of some other domains like

case 1: Accessing abc.google.com and got def.google.com
case 2: Accessing *.abc.google.com and got abc.google.com
case 3: Accessing abc.google.com and got abc.facebook.com

Also, What about programatic calls, for example with JAVA? I know that accessing domain and the domain present in Certificate should strictly match, But i'm not sure if both have same top level domains. Any help would be highly appreciated.

5

The hostname in the subject (common name or subject alternative names) must fully match the name given in the URL. This means that none of the cases you provide will match.

The common browsers and most current command line clients and programming languages properly check for the name by default. But older clients often do not check the name properly (like only against CN, allow multiple wildcards...), don't check the name at all or don't do any certificate validation by default. Also, often developers disable validation partly or fully just because it is in the way of testing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.