5 ex_network_ssl_hostname_8c example
gullradriel edited this page 2026-10-09 00:51:57 +02:00

ex_network_ssl_hostname.c

netw_ssl_do_handshake checks the NAME on the peer certificate, not only that its chain is trusted. SNI says which certificate the server should send. It says nothing about which names are acceptable on it. Without the peer identity that netw_ssl_do_handshake now sets, SSL_VERIFY_PEER validates the chain and stops there, so a certificate issued for any domain the holder controls is accepted for EVERY host: exactly the interception a TLS client exists to detect.

This mints one CA, issues a leaf for "right.test" from it, serves that leaf, and connects twice against the same CA: once asking for "right.test" (accepted) and once asking for "wrong.test" (refused). With verification off the handshake completes either way and the mismatch is reported by netw_ssl_get_verify_result.