subject alternative names not respected by tls.checkServerIdentity #9639
Description
- Version: v6.9.1
- Platform: Linux 4.4.0-47-generic contributing: commiter git FAQ #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
- Subsystem: tls
The tls.checkServerIdentity (https://github.com/nodejs/node/blob/master/lib/tls.js#L144) function assumes that subject alternative names can be accessed as cert.subjectaltname. Tests also use this: https://github.com/nodejs/node/blob/master/test/parallel/test-tls-check-server-identity.js#L59
At the same time the certificate object looks like something like this (as reported by tls.connect):
{
subject: {
CN: 'server',
subjectAltName: 'DNS.1=localhost,DNS.2=vertis.com'
},
issuer: { CN: 'server-ca' },
modulus: 'BF6E...',
exponent: '0x10001',
valid_from: 'Nov 16 13:36:31 2016 GMT',
valid_to: 'Mar 31 13:36:31 2018 GMT',
fingerprint: 'D1:9D:36:92:A6:E8:6D:80:48:89:FF:CA:73:1D:76:4F:C7:73:0B:1C',
serialNumber: 'E70DDB6FE3209190',
raw: <Buffer 30 82 02 ...>
}
This way the alt names will never be respected.