Re: TLS hostname check failure and subjectAltname extension

[Michael Ströder <michael@stroeder.com>]

Michael Ströder wrote:
> We're using self-compiled OpenLDAP 2.4.27 under RHEL 6.1 linked against
> OpenSSL 1.0.0 libs shipped with RHEL.
>
> (some names are consistently obfuscated herein to keep real names confidential)
>
> Unfortunately we can't get StartTLS to work. It always fails:
>
> # /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap-srv01.rz.domain
> ldap_start_tls: Connect error (-11)
> additional info: TLS: hostname does not match CN in peer certificate
> # /opt/xxxdir/bin/ldapsearch -x -ZZ ldap://ldap.domain
> ldap_start_tls: Connect error (-11)
> additional info: TLS: hostname does not match CN in peer certificate
>
> But OpenSSL lists the (IMO correct) hostnames in the server's certificate:
>
> ---------------------------------- snip ----------------------------------
> Subject: CN=ldap.domain,OU=xxx,O=xxx,C=DE
> [..]
> X509v3 Subject Alternative Name:
> email:certificate@xxx.domain,
> DNS:ldap.domain,
> DNS:ldap-srv01.rz.domain,
> DNS:ldap-srv02.rz.domain
> ---------------------------------- snip ----------------------------------
>
> Is the hostname check confused by the email in the first subjectAltName
> sequence value?

I tried to understand the code in function tlso_session_chkhost() in 
libraries/libldap/tls_o.c (RE24) but got totally confused by the use of vars 
ntype and gn->type.

Ciao, Michael.