1

In presence of 'trust certificates' & other attributes .. how important is this?

Does OpenSSL implement it now & If not why does OpenSSL not implement?

This is between non browser client & server.

4

When you connect to a server and the server returns a valid certificate, then you "know" (subject to the vagaries of PKI) that you have connected to a "valid" server, whose identity is contained in the certificate. However, there is more than one SSL server on this planet. You still have to decide whether the server you contacted is the one you wanted to talk to. That's what the name check means.

This is the distinction between authentication (verifying who you are talking to) and authorization (deciding whether who you are talking to is indeed who you should be talking to). You need both. If you remove the name check then you must implement some other mechanism which allows your client to distinguish between the genuine server, and some other server with another name.

  • 1
    I Think you misunderstood the question here. OP is asking if its important to check the hostname against the hostname specified while connecting. Thats not important. If you connect to lb.someserver.com and the certificate is vs.anotherserver.com and you in some way know that vs.anotherserver.com is the correct server (for example in a client configuration file), then it wont matter that it does not precisely match whats in DNS. – sebastian nielsen Mar 18 '15 at 6:13
  • @Thomas Pornin, Could you explain how hostname checking works? What is the safe way to check hostname? I am not sure how we can be ensured that address X is X in fact. – Gilgamesz Jun 6 '17 at 20:34
2

It is still just as important. Even if I am Mr.BadHacker, I can get a trusted certificate saying that I am Mr.BadHacker. If you are trying to connect to your office via SSH and you accept a trusted connection to Mr.BadHacker as being your office, then you are going to have problems.

Trust doesn't mean that the site is good, it simply means that they are who they say they are. It is completely meaningless without also checking who they claim to be.

1

The other answers already said why it is important to check the identity (hostname).

As for the how with openssl: current releases (1.0.1) do not have the necessary checks so most users of openssl code their own (and often wrong) or omit the check (even worse).

In the code base planned for release 1.1 there is a function x509_check_host which should be better than no checks, but its implementation is wrong too (see OpenSSL ticket #3288).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.