0

This is bit of a follow up question for SSL verification of host name of https server

I'm trying to request a page through HTTPS directly from an IP rather than a hostname. Concerning the answers to the question above I understand why the certificate is based on hostname rather than IP. However, I still want to request the page directly from the IP rather than a hostname, basically bypassing the DNS lookup.

As far as I know, the only way to do this is to avoid validating the certificate. Obviously not the most secure method. Is there a way instead to have SSL check the certificate against the hostname (known to the client) while still requesting an IP directly?

|improve this question
  • 1
    What client software do you use for requesting your page ? – binarym Oct 28 '16 at 15:43
  • if you already know the hostname, why not request with the hostname? – Limit Oct 28 '16 at 15:47
  • This does not make any sense: the servers certificate is checked by the client. The HTTP Host header is included by the client in the request to the server. Therefore the client must know the hostname already. Apart from that the client is validating the server certificate and not the server is validating its own certificate based on the Host header sent by the client. I'm voting to close this question because it is too unclear. – Steffen Ullrich Oct 28 '16 at 15:52
  • 1
    May you explain why you will request it by ip, not by hostname? To make the validation possible, the client would need to know the hostname. Why would it not be used? – CristianTM Oct 28 '16 at 17:33
  • @binarym right now I'm using Python and specifically the Tornado framework – Jad S Oct 28 '16 at 17:45
3

Doing a HTTPS connection to some site is basically done this way:

  1. get the IP address for the target hostname by using DNS
  2. connect with TCP to this IP address
  3. do the SSL handshake over this TCP connection, which includes
    1. optionally include the target hostname with the SNI extension in the start of the handshake (ClientHello). This is needed if multiple servers with different certificates share the same IP address and port.
    2. verify the certificate received from the server within the handshake to see if it is trusted and also if it is valid for the target hostname
  4. once the SSL handshake is done send the HTTP request inside this SSL connection, which includes among other things the Host header

What you effectively want is to skip the DNS lookup (step 1) because you already know the IP address of the target. You still need to all the other steps, notably 3.1 (SNI) and 3.2 (validation of hostname inside certificate).

This is possible but how this is done depends on your programming language and libraries. Most languages make only the common case easy for you (i.e. connect by hostname) and uncommon cases like yours are more complex to implement. For example in Perl you could simply use the following code to connect to a site by IP address, but include the proper SNI extension for the target hostname and also check the certificate against the hostname:

use IO::Socket::SSL 1.971;
my $socket = IO::Socket::SSL->new(
    PeerAddr => '1.2.3.4:443',
    SSL_hostname => 'www.example.com'
);

How this is done in the language of your choice is off-topic here and on-topic at stackoverflow.com.

|improve this answer
  • 5
    if all they want is to avoid the DNS lookup, they should just put the hostname and hardcoded IP address in /etc/hosts and use the regular application as usual. – Z.T. Oct 28 '16 at 18:15
  • @Z.T. that's also a potential solution. However for configuration and to keep the system dynamic w.r.t. the IP/Hosts that it needs to handle, I'd rather try to solve the issue directly within the code. – Jad S Oct 28 '16 at 18:41
  • @Z.T.: your solution works only when the user has the permissions to modify such system settings. – Steffen Ullrich Oct 28 '16 at 18:42
  • In python, was able to include the proper SNI using the server_hostname kwarg of the ssl.SSLContext object : sock = context.wrap_socket(sock, server_hostname=hostname) – Jad S Oct 28 '16 at 19:04
0

Certificates are issued for Fully Qualified Domain Names and not IP addresses. You cannot change the logic to just validate the Host: header. However you can always ignore the error which is 'Common Name doesn't match FQDN'

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.