[jira] [Updated] (TS-4480) Wildcards in certificates should only match one level

["Leif Hedstrom (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TS-4480?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Leif Hedstrom updated TS-4480:
------------------------------
    Fix Version/s: 7.0.0

> Wildcards in certificates should only match one level
> -----------------------------------------------------
>
>                 Key: TS-4480
>                 URL: https://issues.apache.org/jira/browse/TS-4480
>             Project: Traffic Server
>          Issue Type: Bug
>          Components: Core, SSL
>            Reporter: Michael Sokolnicki
>             Fix For: 7.0.0
>
>
> According to RFC 6125 section 6.4.3:
> {quote}
> If the wildcard character is the only character of the left-most label in the presented identifier, the client SHOULD NOT compare against anything but the left-most label of the reference identifier (e.g., *.example.com would match foo.example.com but not bar.foo.example.com or example.com).
> {quote}
> In the current implementation, certificates are searched for in a trie, and the longest match is returned, but there is no check if that match complies with the above rule. This causes invalid certs to be returned and SLL errors in the browser (in Firefox, we get SSL_ERROR_BAD_CERT_DOMAIN).



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)