openssh unix dev - Sep 2021 - www.openssh.com certificate misconfiguration

On 03.09.21 16:28, Dmitry Belyavskiy wrote:
> The site www.openssh.com is misconfigured and sometimes browsers refuse to
> connect because of hostname mismatch - the certificate provided by the site
> is issued for www.openbsd.org. Could you please fix it?
There is nothing broken - the server cert lists "www.openssh.com" in
the
Subject Alternate Names (SANs), along with a dozen others.

The DN contains "www.openbsd.org" as the CN, but a) there can be only
one *there*, b) the current standards suggest that browsers(!) should
ignore the DN in favor of the SANs altogether, and c) before that, they
were supposed to accept *both* for quite a while.

Regards,
-- 
Jochen Bern
Systemingenieur

Binect GmbH

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3449 bytes
Desc: S/MIME Cryptographic Signature
URL:
<http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20210903/a4563603/attachment.p7s>

On Fri, Sep 3, 2021 at 8:18 AM Jochen Bern <Jochen.Bern at binect.de>
wrote:
> On 03.09.21 16:28, Dmitry Belyavskiy wrote:
> > The site www.openssh.com is misconfigured and sometimes browsers
refuse
> to
> > connect because of hostname mismatch - the certificate provided by the
> site
> > is issued for www.openbsd.org. Could you please fix it?
>
> There is nothing broken - the server cert lists "www.openssh.com"
in the
> Subject Alternate Names (SANs), along with a dozen others.
>
There is nothing broken on *www.openssh.com*. There *is* something broken
on www.openssh.org which redirects to www.openssh.com.


Tom.III


>
> The DN contains "www.openbsd.org" as the CN, but a) there can be
only
> one *there*, b) the current standards suggest that browsers(!) should
> ignore the DN in favor of the SANs altogether, and c) before that, they
> were supposed to accept *both* for quite a while.
>
> Regards,
> --
> Jochen Bern
> Systemingenieur
>
> Binect GmbH
>
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
>