Question

From the open ssl document presented for the function “SSL_get_verify_result” here:
http://www.openssl.org/docs/ssl/SSL_get_verify_result.html
It states that the errors are given here:
http://www.openssl.org/docs/apps/verify.html

So which of these errors will be invoked if there is an SSL host Mismatch error?
i.e hostname in certificate and hostname from request is different?

And also which of those errors can actually be safe to ignore?

Answer 1

SSL_get_verify_result doesnot do a hostname mismatch search. We have to do that manually taking into consideration multiple CN’s and subject alternative names(SAN’s) that come in the certificate.

The functions that can be used for handling multiple CN’s are :

int lastpos = -1;
lastpos=X509_NAME_get_index_by_NID(X509_get_subject_name(cert), NID_commonName, lastpos);
X509_NAME_get_entry(X509_get_subject_name(cert), lastpos);

calling X509_NAME_get_index_by_NID again using the new lastpos will give us the next CN until it returns -1 which says there are no more CN’s available.

this function gives a X509_NAME_ENTRY *, which can be converted to char * using ASN1_STRING_to_UTF8.

Be sure to consider the wildcards that come in the SAN’s and CN’s