bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Lars Ingebrigtsen]

I've been seeing some warnings about invalid TLS certificates lately
that seem kinda unlikely.  I mean, it's from major sites that shouldn't
have broken TLS certificates.  And the error is always that the host
name doesn't match the name of the certificate.

Which made me wonder: Does gnutls.c support SAN (subject alternate
names), which is a way to list oodles of host names in a single
certificate?  I can't find any mention of this in the code...

I'll try to get a test case going, but this bug report is mainly to
remind myself not to forget this again, which I've done the previous
dozen times this has happened.


In GNU Emacs 26.0.50 (build 7, x86_64-pc-linux-gnu, GTK+ Version 3.22.11)
 of 2017-09-13 built on mouse
Repository revision: bdb71dea4a478115bde5c8260f228613d6717157
Windowing system distributor 'The X.Org Foundation', version 11.0.11903000
System Description:	Ubuntu 17.04


-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Robert Pluim]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> I've been seeing some warnings about invalid TLS certificates lately
> that seem kinda unlikely.  I mean, it's from major sites that shouldn't
> have broken TLS certificates.  And the error is always that the host
> name doesn't match the name of the certificate.
>
> Which made me wonder: Does gnutls.c support SAN (subject alternate
> names), which is a way to list oodles of host names in a single
> certificate?  I can't find any mention of this in the code...
>

Good question. Example sites/certificates? (I have a vague memory of
there being more than one way to do SAN, perhaps we're looking at the
wrong field)

Regards

Robert

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Lars Ingebrigtsen]

Robert Pluim <rpluim@gmail.com> writes:

> Good question. Example sites/certificates? (I have a vague memory of
> there being more than one way to do SAN, perhaps we're looking at the
> wrong field)

https://1000-sans.badssl.com/

has a lot of SANs.  :-)

Of course, after reporting this bug, it hasn't happened once to me
afterwards (that Emacs has claimed that it can't verify a certificate
due to a bad host name), so I've been unable to pursue this (possible)
issue any further...

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Robert Pluim]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> Robert Pluim <rpluim@gmail.com> writes:
>
>> Good question. Example sites/certificates? (I have a vague memory of
>> there being more than one way to do SAN, perhaps we're looking at the
>> wrong field)
>
> https://1000-sans.badssl.com/
>
> has a lot of SANs.  :-)
>

Yes, but that one works fine for me :-)

> Of course, after reporting this bug, it hasn't happened once to me
> afterwards (that Emacs has claimed that it can't verify a certificate
> due to a bad host name), so I've been unable to pursue this (possible)
> issue any further...

I've just re-read
<https://tools.ietf.org/html/rfc5280#section-4.2.1.6> and it looks
like there is ample scope for getting things wrong there....

Regards

Robert

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Lars Ingebrigtsen]

Finally, I got one of these warnings on a web site:

`M-x eww RET
http://media.boingboing.net/wp-content/uploads/2017/01/Autonomous_Design20by20Will20Staehle.jpg RET'

But!  It looks like this is a genuine error: Firefox gives the same
warning...  So perhaps this isn't an issue after all?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Robert Pluim]

Lars Ingebrigtsen <larsi@gnus.org> writes:

> Finally, I got one of these warnings on a web site:
>
> `M-x eww RET
> http://media.boingboing.net/wp-content/uploads/2017/01/Autonomous_Design20by20Will20Staehle.jpg RET'
>
> But!  It looks like this is a genuine error: Firefox gives the same
> warning...  So perhaps this isn't an issue after all?

Also: that http URL redirects to https. If you access the https
version directly, it uses a different certificate than the redirected
one. Neither eww nor chrome complain about the non-redirected one.

Regards

Robert

bug#28458: 26.0.50; Does Emacs support SAN (subject alternate names)?

[Noam Postavsky]

# not an Emacs bug
tags 28458 notabug
close 28458
quit

Robert Pluim <rpluim@gmail.com> writes:

> Lars Ingebrigtsen <larsi@gnus.org> writes:
>
>> Finally, I got one of these warnings on a web site:
>>
>> `M-x eww RET
>> http://media.boingboing.net/wp-content/uploads/2017/01/Autonomous_Design20by20Will20Staehle.jpg RET'
>>
>> But!  It looks like this is a genuine error: Firefox gives the same
>> warning...  So perhaps this isn't an issue after all?
>
> Also: that http URL redirects to https. If you access the https
> version directly, it uses a different certificate than the redirected
> one. Neither eww nor chrome complain about the non-redirected one.

Seems to be fixed on the remote end now.