ruby-net-ldap icon indicating copy to clipboard operation
ruby-net-ldap copied to clipboard

Don't verify hostname when verify_hostname is false in tls_options

Open jurta opened this issue 5 years ago • 1 comments

https://ruby.github.io/openssl/OpenSSL/SSL/SSLContext.html documents the option verify_hostname as whether to check the server certificate is valid for the hostname.

But when I set verify_hostname to false in tls_options, it has no effect, it still reports the error "hostname does not match the server certificate".

Then I found this is the result of #259 but the assumption is wrong that users who don't care about hostname validation should set verify_mode to OpenSSL::SSL::VERIFY_NONE. This disables the certificate validation completely. Maybe the reason why #259 didn't add a check for verify_hostname is because verify_hostname was added later in https://github.com/ruby/openssl/pull/60 (i.e. the same year but a few months later).

So for more fine-grained configuration to disable only hostname verification without disabling certificate validation, here is this pull request.

jurta avatar Feb 14 '20 13:02 jurta

Any updates on this?

secos avatar Apr 22 '20 21:04 secos