public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
* reg: Host Name Validation with Wild Card Certificate
@ 2020-03-06  6:07 Sivaraman Nainar
  2020-03-07 22:40 ` [edk2-devel] " Sean
  0 siblings, 1 reply; 5+ messages in thread
From: Sivaraman Nainar @ 2020-03-06  6:07 UTC (permalink / raw)
  To: To:, Wu, Jiaxin, Fu, Siyuan
  Cc: Madhan B. Santharam, Arun Subramanian  B, Bhuvaneshwari M R,
	Ramesh R., Srini Narayana

[-- Attachment #1: Type: text/plain, Size: 825 bytes --]

Hello all:

Need a clarification on the Host Name support added in the HTTP Boot.

When certificates are generated with the Wild Card in the SAN  the host name validation is getting failed with the below error codes.
Ex: DNS Name=*.ami.internal-test.com

TlsDoHandshake SSL_HANDSHAKE_ERROR State=0x4 SSL_ERROR_SSL
TlsDoHandshake ERROR 0x1416F086=L14:F16F:R86
Http Request failed. Code=Aborted

If the Host verify flag is changed from
HttpInstance->TlsConfigData.VerifyHost.Flags    = EFI_TLS_VERIFY_FLAG_NO_WILDCARDS;
To
HttpInstance->TlsConfigData.VerifyHost.Flags    =  EFI_TLS_VERIFY_FLAG_NONE;

Then the Http request can pass.

Is the host Name support strictly not allowing Wild card support? In this case do we need to have multiple Certiricate to have each URL with exact Host Name?

Thanks
Siva

[-- Attachment #2: Type: text/html, Size: 4050 bytes --]

^ permalink raw reply	[flat|nested] 5+ messages in thread
[parent not found: <15F9A1F7132299A3.15852@groups.io>]

end of thread, other threads:[~2020-03-12  0:04 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-03-06  6:07 reg: Host Name Validation with Wild Card Certificate Sivaraman Nainar
2020-03-07 22:40 ` [edk2-devel] " Sean
2020-03-08  8:54   ` Laszlo Ersek
     [not found] <15F9A1F7132299A3.15852@groups.io>
2020-03-10  9:04 ` Sivaraman Nainar
2020-03-12  0:04   ` Wu, Jiaxin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox