In presence of 'trust certificates' & other attributes .. how important is this?
Does OpenSSL implement it now & If not why does OpenSSL not implement?
This is between non browser client & server.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
When you connect to a server and the server returns a valid certificate, then you "know" (subject to the vagaries of PKI) that you have connected to a "valid" server, whose identity is contained in the certificate. However, there is more than one SSL server on this planet. You still have to decide whether the server you contacted is the one you wanted to talk to. That's what the name check means.
This is the distinction between authentication (verifying who you are talking to) and authorization (deciding whether who you are talking to is indeed who you should be talking to). You need both. If you remove the name check then you must implement some other mechanism which allows your client to distinguish between the genuine server, and some other server with another name.
It is still just as important. Even if I am Mr.BadHacker, I can get a trusted certificate saying that I am Mr.BadHacker. If you are trying to connect to your office via SSH and you accept a trusted connection to Mr.BadHacker as being your office, then you are going to have problems.
Trust doesn't mean that the site is good, it simply means that they are who they say they are. It is completely meaningless without also checking who they claim to be.
The other answers already said why it is important to check the identity (hostname).
As for the how with openssl: current releases (1.0.1) do not have the necessary checks so most users of openssl code their own (and often wrong) or omit the check (even worse).
In the code base planned for release 1.1 there is a function x509_check_host which should be better than no checks, but its implementation is wrong too (see OpenSSL ticket #3288).