I have set up a certificate-based connection with socat using this tutorial: http://www.dest-unreach.org/socat/doc/socat-openssltunnel.html
My socat connection works as following (only the relevant parts of the command):
I'm doing this for a university course and there is an additional question asking what security problems could arise due to the line
NOTE: The server certificate is only checked for validity against cafile or capath, but not for match with the server’s name or its IP address.
Now I'm not sure whether or not I understand this correctly, the way I do is:
server.pem file (
.crt combined) is checked whether or not it matches the client's
server.crt, however it does not check the certificate's (
server.crt) CN for a match on the server's domain/IP/whatever.
If that is correct, I fail to find any critical security problems without having the server's private key having to be stolen (in which case you've already lost anyways).