How to enable tls/ssl domain subject name validation?

[jarpz]

@jpwsutton

Description of Bug:

Try to connect to tls/ssl domain and the subject domain in the certificate is from another domain. The result is connection is success. This behavior allow put any mitm between the client and the server.

• Is there a way to activate this validation?
• Is it a bug?

[jpwsutton]

Thanks this is a good point, I don't think that by default java does hostname verification. We should be able to do something like this: http://stackoverflow.com/questions/18139448/how-should-i-do-hostname-validation-when-using-jsse

[Legion2]

Is there any update on this, just run into it and wonder why the client connected to a broker which had a wrong tls configuration.