I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a string comparison.
I.e. if the certificate has been issued to an IP and the user types a name instead e.g. https://secureserver/
but the IP<->secureserver (maps e.g. configured in windows host file) the verification fails complaining that
javax.net.ssl.SSLException: hostname in certificate didn't match:
<secureserver> != <10.4.5.1>
Is this the way usually implemented in all libraries? I.e. am I wrong to have expected that a reverse lookup for secureserver
to 10.4.5.1
. that is the CN of the certificate should have occured?
Thanks