Fix OpenSSL cert validation when host is an IP address (#581) - #588
Merged
Conversation
X509_VERIFY_PARAM_set1_host only validates the certificate against dNSName / CN SAN entries, so connecting to a host given as a literal IPv4 or IPv6 address (e.g. wss://127.0.0.1/) always failed hostname verification even when the certificate carried a matching iPAddress SAN. Detect IP literals with inet_pton and validate them against the iPAddress SANs via X509_VERIFY_PARAM_set1_ip_asc instead, falling back to set1_host for DNS names. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Closed
bsergean
added a commit
that referenced
this pull request
Jun 25, 2026
Release of accumulated fixes since v12.0.0: DNS lookup crash/offline resolution (#589), OpenSSL IP-address cert validation (#588), case-insensitive Upgrade header (#584), server fd double-close (#585), fragment buffering optimization (#562), and the install include-dir fix (#582). Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #581
Problem
When connecting as a TLS client to a host specified as a literal IP address (e.g.
wss://127.0.0.1:44300/) with OpenSSL as the TLS provider, x509 certificate verification always fails — even when the server certificate carries a matchingiPAddressSubject Alternative Name.The cause is that
SocketOpenSSL::connectunconditionally callsX509_VERIFY_PARAM_set1_host, which only validates againstdNSName/ CN SAN entries. IP literals must instead be validated againstiPAddressSAN entries.Fix
Detect whether
hostis an IPv4 or IPv6 literal using the existingix::inet_ptonhelper, and in that case validate viaX509_VERIFY_PARAM_set1_ip_asc. DNS names keep usingX509_VERIFY_PARAM_set1_hostas before.This follows the approach suggested in the issue, made portable (avoids the Windows-only
in_addr::S_ununion member) and using the library's owninet_ptonwrapper.Testing
-DUSE_TLS=ON -DUSE_OPEN_SSL=ON(OpenSSL 3.6.1).DNS=localhost, IPAddress=127.0.0.1, connecting via bothwss://127.0.0.1:44300/andwss://localhost:44300/.🤖 Generated with Claude Code