From: Jeff King <peff@peff.net>
To: Mattia Tomasoni <Mattia.Tomasoni.8371@student.uu.se>
Cc: git@vger.kernel.org
Subject: Re: certificate problem for *.github.com
Date: Thu, 4 Nov 2010 11:46:00 -0400 [thread overview]
Message-ID: <20101104154600.GA30026@sigill.intra.peff.net> (raw)
In-Reply-To: <20101104162135.47chayboagwwkcc8@webmail.uu.se>
On Thu, Nov 04, 2010 at 04:21:35PM +0100, Mattia Tomasoni wrote:
> I get:
> certificate common name `*.github.com' doesn't match requested host
> name `github.com'
>
> wget --no-check-certificate works...
The problem is that wildcard names in certificates are not
well-specified. RFC 2818 leaves this particular case (matching
"*.domain" to "domain") ambiguous:
Names may contain the wildcard character * which is considered to
match any single domain name component or component fragment. E.g.,
*.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches
foo.com but not bar.com.
RFC 2595 specifically outlaws it, but is talking about other non-HTTP
protocols (it is for TLS with IMAP, POP, and ACAP):
A "*" wildcard character MAY be used as the left-most name component
in the certificate. For example, *.example.com would match
a.example.com, foo.example.com, etc. but would not match example.com.
So you can either send a bug report to wget to handle this case better,
or you can complain to github not to use wildcard certificates in this
way.
-Peff
prev parent reply other threads:[~2010-11-04 15:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-04 15:21 certificate problem for *.github.com Mattia Tomasoni
2010-11-04 15:46 ` Jeff King [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101104154600.GA30026@sigill.intra.peff.net \
--to=peff@peff.net \
--cc=Mattia.Tomasoni.8371@student.uu.se \
--cc=git@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).