-
Notifications
You must be signed in to change notification settings - Fork 164
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rustls is unable to handle TLS certificates with IP addresses in SAN DNS names #257
Comments
I think this is a bug on DigitalOcean's side, so I have raised a support ticket there too. I think there is probably nothing actionable for webpki to do here. It'd be really nice if the webpki error messages could tell me the root cause for things like this, so I don't have to add println statements in the webpki source to figure out where things are going wrong. |
This should be fixed as soon as #54 is fixed. |
@mvforell I don't think so. The issue here is that there is an IP address in a SAN DNS record, not an IP address record. |
@lucacasonato It has the IP address as a SAN at the end too, so with #260 it should work. |
Yes, but it errors as soon as it reaches the invalid DNS SAN record. So even with #54 it will still crash |
Yes, sorry for the noise, that's right. |
Example:
Dump of the certificate:
Rustls get's hung up on the
DNS:46.101.236.135
SAN entry.is_valid_dns_id
fails on this entry becauselabel_is_all_numeric
istrue
.OpenSSL handles this certificate just fine.
All postgres databases provisioned by DigitalOcean have this SAN entry in their certs. Should I report this to them as an issue, or is this something that should be addressed in webpki?
The text was updated successfully, but these errors were encountered: