ruby-net-ldap
ruby-net-ldap copied to clipboard
Don't verify hostname when verify_hostname is false in tls_options
https://ruby.github.io/openssl/OpenSSL/SSL/SSLContext.html documents the option verify_hostname
as whether to check the server certificate is valid for the hostname.
But when I set verify_hostname
to false
in tls_options
, it has no effect, it still reports the error "hostname does not match the server certificate".
Then I found this is the result of #259 but the assumption is wrong that users who don't care about hostname validation should set verify_mode
to OpenSSL::SSL::VERIFY_NONE
. This disables the certificate validation completely. Maybe the reason why #259 didn't add a check for verify_hostname
is because verify_hostname
was added later in https://github.com/ruby/openssl/pull/60 (i.e. the same year but a few months later).
So for more fine-grained configuration to disable only hostname verification without disabling certificate validation, here is this pull request.
Any updates on this?