diff options
| author | Jeremy Evans <code@jeremyevans.net> | 2022-01-04 11:32:11 -0800 |
|---|---|---|
| committer | Jeremy Evans <code@jeremyevans.net> | 2022-01-04 11:35:17 -0800 |
| commit | 717d7009d6926b1f076f6ac0178b3861ae6e20da (patch) | |
| tree | 0dbb96590e70100e96851d1cf5fc0655deba1356 | |
| parent | bff4080091f1e468418b0a8625174f234922210c (diff) | |
| download | ruby-openssl-717d7009d6926b1f076f6ac0178b3861ae6e20da.tar.gz | |
Skip optional wildcard SAN tests on LibreSSL 3.5.0+
RFC 6066 states how some wildcard SAN entries MAY be handled, but
it does not say they MUST be handled. LibreSSL 3.5.0 only handles
suffix wildcard SANs, not prefix wildcard SANs, or interior
wildcard SANs, so return early from the wildcard SAN tests on
LibreSSL 3.5.0.
Fixes #471
| -rw-r--r-- | test/openssl/test_ssl.rb | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb index a7607da0..39964bf4 100644 --- a/test/openssl/test_ssl.rb +++ b/test/openssl/test_ssl.rb @@ -676,10 +676,16 @@ class OpenSSL::TestSSL < OpenSSL::SSLTestCase # buzz.example.net, respectively). ... assert_equal(true, OpenSSL::SSL.verify_certificate_identity( create_cert_with_san('DNS:baz*.example.com'), 'baz1.example.com')) + + # LibreSSL 3.5.0+ doesn't support other wildcard certificates + # (it isn't required to, as RFC states MAY, not MUST) + return if libressl?(3, 5, 0) + assert_equal(true, OpenSSL::SSL.verify_certificate_identity( create_cert_with_san('DNS:*baz.example.com'), 'foobaz.example.com')) assert_equal(true, OpenSSL::SSL.verify_certificate_identity( create_cert_with_san('DNS:b*z.example.com'), 'buzz.example.com')) + # Section 6.4.3 of RFC6125 states that client should NOT match identifier # where wildcard is other than left-most label. # |