Mercurial > hg

diff mercurial/sslutil.py @ 14666:27b080aa880a

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
sslutil: fall back to commonName when no dNSName in subjectAltName (issue2798) Any entries in subjectAltName would prevent fallback to using commonName, but RFC 2818 says: If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. We now only consider dNSNames in subjectAltName. (dNSName is known as 'DNS' in OpenSSL/Python.)
author Nicolas Bareil <nico@chdir.org>
date Sat, 18 Jun 2011 01:03:03 +0200
parents 64dfbe576455
children 8f12dac18d13
line wrap: on
line diff
--- a/mercurial/sslutil.py	Fri Jun 17 15:43:50 2011 -0500
+++ b/mercurial/sslutil.py	Sat Jun 18 01:03:03 2011 +0200
@@ -48,7 +48,8 @@
         for name in certnames:
             if matchdnsname(name):
                 return None
-        return _('certificate is for %s') % ', '.join(certnames)
+        if certnames:
+            return _('certificate is for %s') % ', '.join(certnames)
 
     # subject is only checked when subjectAltName is empty
     for s in cert.get('subject', []):