Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow setting the server hostname for TLS connection #83

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ameir
Copy link

@ameir ameir commented Jul 11, 2018

When using SAN certs, hostname verification is enforced. If the server hostname in server_addr doesn't match one of the names in the cert, thenthe connection fails. This PR allows you to specify an allowed hostname. The use-case for this is that we have auto-generated certs per node in AWS,but are establishing the tunnel through an NLB. The NLB hostname does not match what is in the cert, so the connection fails without this patch.

…r hostname in `server_addr` doesn't match one of the names in the cert, then the connection fails. This PR allows you to specify an allowed hostname. The use-case for this is that we have auto-generated certs per node in AWS, but are establishing the tunnel through an NLB. The NLB hostname does not match what is in the cert, so the connection fails without this patch.
@mmatczuk
Copy link
Owner

If the server hostname in server_addr doesn't match one of the names in the cert, thenthe connection fails.

In my view this is a generally expected behavior and adding the change would be confusing for other users.

I believe your problem shall be solved by a better cert generation and DNS service registration.

@ameir
Copy link
Author

ameir commented Jul 15, 2018 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants