3

I've noticed companies like cloudflare or wordpress.com seem to offer a kind of "3rd party" SSL certificate to their customers, and when viewing certificates of the websites that use these services, the Common name often corresponds to cloudflare, sucuri, automattic etc and not to the domain name of the url being requested. here is a screen shot example

enter image description here

This seems to indicate that the browser (in this case chrome Version 59.0) doesn't check this. Does the TLS protocol require that the domain/hostname being requested has to match the Common name on the public key certificate?

  • 3
    To be exact, TLS doesn't require verifying hostname (it can be used for protocols that don't have hostnames) but HTTPS does, see rfc2818. – dave_thompson_085 Jun 18 '17 at 6:26
2

It does check the DNS name matches the certificate, however it also validates if the domain name is in the alternative name field.

If you download the SSL certificate for www.seedprod.com, you'll find:

-----BEGIN CERTIFICATE-----
MIIGQzCCBeugAwIBAgIRAPdMB9xtmbIZDI9ahTm4MRcwCgYIKoZIzj0EAwIwgZIx
CzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNV
BAcTB1NhbGZvcmQxGjAYBgNVBAoTEUNPTU9ETyBDQSBMaW1pdGVkMTgwNgYDVQQD
Ey9DT01PRE8gRUNDIERvbWFpbiBWYWxpZGF0aW9uIFNlY3VyZSBTZXJ2ZXIgQ0Eg
MjAeFw0xNzA0MjgwMDAwMDBaFw0xNzExMDQyMzU5NTlaMGwxITAfBgNVBAsTGERv
bWFpbiBDb250cm9sIFZhbGlkYXRlZDEhMB8GA1UECxMYUG9zaXRpdmVTU0wgTXVs
dGktRG9tYWluMSQwIgYDVQQDExtzc2wzNzgwOTQuY2xvdWRmbGFyZXNzbC5jb20w
WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASu4JtvmTPQZHm10bG4CVuOg2O9qVWC
t09Hx0vBnLVoln7Z25glBjo8bPcQpzZ5ELnHiRDnfXOFip9mqx1Ha7ito4IERTCC
BEEwHwYDVR0jBBgwFoAUQAlhZ/C8g3FP3hIILG/U1Ct2PZYwHQYDVR0OBBYEFLoE
5sVmZxdES/mk31Ix6XhvqKbzMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAA
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBPBgNVHSAESDBGMDoGCysG
AQQBsjEBAgIHMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2VjdXJlLmNvbW9kby5j
b20vQ1BTMAgGBmeBDAECATBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLmNv
bW9kb2NhNC5jb20vQ09NT0RPRUNDRG9tYWluVmFsaWRhdGlvblNlY3VyZVNlcnZl
ckNBMi5jcmwwgYgGCCsGAQUFBwEBBHwwejBRBggrBgEFBQcwAoZFaHR0cDovL2Ny
dC5jb21vZG9jYTQuY29tL0NPTU9ET0VDQ0RvbWFpblZhbGlkYXRpb25TZWN1cmVT
ZXJ2ZXJDQTIuY3J0MCUGCCsGAQUFBzABhhlodHRwOi8vb2NzcC5jb21vZG9jYTQu
Y29tMIICjAYDVR0RBIICgzCCAn+CG3NzbDM3ODA5NC5jbG91ZGZsYXJlc3NsLmNv
bYIgKi5icmF2ZWVhZ2xld2VhbHRobWFuYWdlbWVudC5jb22CFCouY29taW5nc29v
bnBhZ2UuY29tgg8qLmNvbW9sb2dpYS5jb22CDiouZGlub2Z1cnMuY29tgg4qLmVw
aWtjaGF0LmNvbYIVKi5oZWF0cHJlc3NuYXRpb24uY29tgg8qLml2YW50aS5jb20u
YXWCCyouaXZhbnRpLmN6ggsqLml2YW50aS5kZYILKi5pdmFudGkuZXOCCyouaXZh
bnRpLmZyggsqLml2YW50aS5pdIILKi5pdmFudGkucGyCDSoubXRhcGF5Mi5jb22C
FioucGF1bGhvd2VsbGRlc2lnbi5jb22CFSouc2Nwcm9wZXJ0aWVzLmNvbS5hdYIO
Ki5zZWVkcHJvZC5jb22CFCoudGhlYXJ0b2ZhZHZpY2UuY29tgh5icmF2ZWVhZ2xl
d2VhbHRobWFuYWdlbWVudC5jb22CEmNvbWluZ3Nvb25wYWdlLmNvbYINY29tb2xv
Z2lhLmNvbYIMZGlub2Z1cnMuY29tggxlcGlrY2hhdC5jb22CE2hlYXRwcmVzc25h
dGlvbi5jb22CDWl2YW50aS5jb20uYXWCCWl2YW50aS5jeoIJaXZhbnRpLmRlgglp
dmFudGkuZXOCCWl2YW50aS5mcoIJaXZhbnRpLml0gglpdmFudGkucGyCC210YXBh
eTIuY29tghRwYXVsaG93ZWxsZGVzaWduLmNvbYITc2Nwcm9wZXJ0aWVzLmNvbS5h
dYIMc2VlZHByb2QuY29tghJ0aGVhcnRvZmFkdmljZS5jb20wCgYIKoZIzj0EAwID
RgAwQwIgOaCjhzo/ys/XgLJOgT/bqjtBr49RL8mzmD1a3FP6DnICH0YLws0/K04O
LSik+0+yFS3pTsnK44ONkX1NccykTvI=
-----END CERTIFICATE-----

If you put that in a file seedprod.crt, you can then use openssl to view the full data in the certificate with openssl x509 -in seedprod.crt -text.

Then you will see:

X509v3 Subject Alternative Name:

DNS:ssl378094.cloudflaressl.com, DNS:*.braveeaglewealthmanagement.com, DNS:*.comingsoonpage.com, DNS:*.comologia.com, DNS:*.dinofurs.com, DNS:*.epikchat.com, DNS:*.heatpressnation.com, DNS:*.ivanti.com.au, DNS:*.ivanti.cz, DNS:*.ivanti.de, DNS:*.ivanti.es, DNS:*.ivanti.fr, DNS:*.ivanti.it, DNS:*.ivanti.pl, DNS:*.mtapay2.com, DNS:*.paulhowelldesign.com, DNS:*.scproperties.com.au, DNS:*.seedprod.com, DNS:*.theartofadvice.com, DNS:braveeaglewealthmanagement.com, DNS:comingsoonpage.com, DNS:comologia.com, DNS:dinofurs.com, DNS:epikchat.com, DNS:heatpressnation.com, DNS:ivanti.com.au, DNS:ivanti.cz, DNS:ivanti.de, DNS:ivanti.es, DNS:ivanti.fr, DNS:ivanti.it, DNS:ivanti.pl, DNS:mtapay2.com, DNS:paulhowelldesign.com, DNS:scproperties.com.au, DNS:seedprod.com, DNS:theartofadvice.com

Note DNS:*.seedprod.com and DNS:seedprod.com are in there, so the certificate validates for seedprod.com.

  • thanks, that explains the mismatch for seedprod.com. Here is another domain that has the same mismatch issue but no X509 alternative name. nowayshecodes.com in which the domain name nowayshecodes.com doesn't appear anywhere in the cert. i.e the value for the Alternative names is: X509v3 Subject Alternative Name: DNS:*.wordpress.com, DNS:wordpress.com any idea what is happening in that case? – the_velour_fog Jun 18 '17 at 5:59
  • 1
    @the_velour_fog: I don't know how you checked but the name nowayshecodes.com is contained in the certificate for nowayshecodes.com, right after DNS:nowaypal.com and before DNS:nowaystosayit.com. My guess is that you've checked with openssl s_client but forgot the -servername .. argument which is essential when SNI extension is needed as in this case. – Steffen Ullrich Jun 18 '17 at 6:14
  • 3
    "It does check the DNS name matches the certificate, however it also validates.." - not fully true. CN is long considered obsolete. That's why the standard requires that it should not be checked if DNS SAN exist. And since a few weeks at least Chrome abandoned CN checking completely and requires SAN. See also thesslstore.com/blog/security-changes-in-chrome-58 about the details of Common Name Support Removed. – Steffen Ullrich Jun 18 '17 at 6:18
  • @SteffenUllrich I checked by getting the PEM encoded cert with echo -n | openssl s_client -connect nowayshecodes.com:443 then taking the base64 encoded text between -----BEGIN CERTIFICATE---- and ---------END CERTIFICATE----- then running that through openssl x509 -text . I just repeated and I'm still not seeing the domain name – the_velour_fog Jun 18 '17 at 6:22
  • 1
    @the_velour_fog: to cite myself: but forgot the -servername .. argument which is essential when SNI extension is needed as in this case – Steffen Ullrich Jun 18 '17 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.