Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
While trying to set up an SslStream, the example has a call in the client:
sslStream.AuthenticateAsClient(targetHost);
For AuthenticateAsClient, the documentation states “The value specified for targetHost must match the name on the server's certificate.“
How can I find the targetHost of my x509 certificate?
The rules vary slightly depending on the protocol. Cross-protocol harmonisation efforts have been made in RFC 6125: Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS).
This being said, the RFC 6125 guidelines (meant to be applicable to any protocol that uses SSL/TLS) are more or less the same as those for HTTPS, which are defined in RFC 2818 (HTTP over TLS), Section 3.1.
In short, if the certificate has Subject Alternative Name (SAN) extensions of DNS type, one of them must be the target host name you’re trying to connect to. When there are no such extensions, you must look into the Subject DN of the certificate and find the Common Name (CN) RDN: it must match the target host name.