Opciones de contexto para FTP
CN_match works contrary to intuitive thinking. I came across this when I was developing SSL server implemented in PHP. I stated (in code):
- do not allow self signed certs (works)
- verify peer certs against CA cert (works)
- verify the client's CN against CN_match (does not work), like this:
stream_context_set_option($context, 'ssl', 'CN_match', '*.example.org');
I presumed this would match any client with CN below .example.org domain.
Unfortunately this is NOT the case. The option above does not do that.
What it really does is this:
- it takes client's CN and compares it to CN_match
- IF CLIENT's CN CONTAINS AN ASTERISK like *.example.org, then it is matched against CN_match in wildcard matching fashion
Examples to illustrate behaviour:
(CNM = server's CN_match)
(CCN = client's CN)
- CNM=host.example.org, CCN=host.example.org ---> OK
- CNM=host.example.org, CCN=*.example.org ---> OK
- CNM=.example.org, CCN=*.example.org ---> OK
- CNM=example.org, CCN=*.example.org ---> ERROR
- CNM=*.example.org, CCN=host.example.org ---> ERROR
- CNM=*.example.org, CCN=*.example.org ---> OK
According to PHP sources I believe that the same applies if you are trying to act as Client and the server contains a wildcard certificate. If you set CN_match to myserver.example.org and server presents itself with *.example.org, the connection is allowed.
Everything above applies to PHP version 5.2.12.
I will supply a patch to support CN_match starting with asterisk.
Opciones de contexto para SSL
Opciones de contexto para SSL — Listado de opciones de contexto para SSL
Descripción
Opciones de contexto para transportes ssl:// y tls://
Historial de cambios
| Versión | Descripción |
|---|---|
| 5.3.2 |
Se agregó SNI_enabled y
SNI_server_name.
|
| 5.0.0 |
Se agregó capture_peer_cert,
capture_peer_chain and
ciphers.
|
Notas
Nota: Debido a que ssl:// el es transporte subyacente para las envolturas https:// y ftps://, cualquier opción de contexto que aplique para ssl:// también aplica para https:// y ftps://.
Nota: Para que SNI (Server Name Indication) esté disponible, entonces PHP se debe compilar con OpenSSL 0.9.8j o superior. Se utiliza
OPENSSL_TLSEXT_SERVER_NAMEpara determinar si SNI está soportado.
add a note
User Contributed Notes
Opciones de contexto para SSL - [1 notes]
Botjan kufca ¶
3 years ago