bug#35896: 27.0.50; Gmane certificate host does not match hostname

bug#35896: 27.0.50; Gmane certificate host does not match hostname

[Stefan Monnier]

Package: Emacs
Version: 27.0.50


Whenever gmane update their certificate NSM asks me for confirmation,
saying:

    The TLS connection to news.gmane.org:nntp is insecure for the following
    reason:

    certificate host does not match hostname

If I look at the certificate info above I see:

    Issued to:       CN=news.gmane.org
    Hostname:        news.gmane.org

So to me, it looks like the hostname matches, except maybe for the "CN="
which seems like a mistake.  Is that a mistake on our side or on Gmane's
or on Let's Encrypt?


        Stefan

bug#35896: 27.0.50; Gmane certificate host does not match hostname

[Andreas Schwab]

On Mai 25 2019, Stefan Monnier <monnier@iro.umontreal.ca> wrote:

> Whenever gmane update their certificate NSM asks me for confirmation,
> saying:
>
>     The TLS connection to news.gmane.org:nntp is insecure for the following
>     reason:
>
>     certificate host does not match hostname

Are you sure the question is about news.gmane.org, not news.gwene.org?

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510  2552 DF73 E780 A9DA AEC1
"And now for something completely different."

bug#35896: 27.0.50; Gmane certificate host does not match hostname

[Stefan Monnier]

>> Whenever gmane update their certificate NSM asks me for confirmation,
>> saying:
>>
>>     The TLS connection to news.gmane.org:nntp is insecure for the following
>>     reason:
>>
>>     certificate host does not match hostname
>
> Are you sure the question is about news.gmane.org, not news.gwene.org?

I didn't copy&paste the text (because the prompt is not a minibuffer
and here I'm exposed to the undesirable difference ;-), so maybe you're
right: maybe I didn't read carefully enough to notice it said "gwene"
instead of "gmane".

[...comparing my network-security.data with my backup's...]

Yup, you're right, it seems that it was gwene's so I guess it's
a misconfiguration there where they share a single certificate but only
tell Letsencrypt about one of the two names.

Thanks,


        Stefan