We're using WinHTTP to send API calls from our client. Now according to Common Criteria, FCS_TLSC_EXT.1.2 assurance activity Test 2, if certificate contains a valid CN (common name) but invalid SAN(Subject Alternate Name), the connection should fail.

However, with WinHTTP's internal working, it accepts the invalid SAN (which should not happen). There seems to be no documentation on WinHTTP as to how this can be handled. Because this is internal implementation of WinHTTP.

The test fails with python's request library as well.