Skip to content

Commit f6d232f

Browse files
committed
WiFiClientSecure: match CN and SANs ignoring case
Some websites have certificates with uppercase letters in CN. This change makes _verifyDN function accept such certificates by converting all names to lower case before comparing them. Resolves esp8266#2978
1 parent a8e8ecb commit f6d232f

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

libraries/ESP8266WiFi/src/WiFiClientSecure.cpp

+6-2
Original file line numberDiff line numberDiff line change
@@ -521,14 +521,18 @@ bool WiFiClientSecure::_verifyDN(const char* domain_name)
521521
const char* san = NULL;
522522
int i = 0;
523523
while ((san = ssl_get_cert_subject_alt_dnsname(*_ssl, i)) != NULL) {
524-
if (matchName(String(san), domain_name_str)) {
524+
String san_str(san);
525+
san_str.toLowerCase();
526+
if (matchName(san_str, domain_name_str)) {
525527
return true;
526528
}
527529
DEBUGV("SAN %d: '%s', no match\r\n", i, san);
528530
++i;
529531
}
530532
const char* common_name = ssl_get_cert_dn(*_ssl, SSL_X509_CERT_COMMON_NAME);
531-
if (common_name && matchName(String(common_name), domain_name_str)) {
533+
String common_name_str(common_name);
534+
common_name_str.toLowerCase();
535+
if (common_name && matchName(common_name_str, domain_name_str)) {
532536
return true;
533537
}
534538
DEBUGV("CN: '%s', no match\r\n", (common_name)?common_name:"(null)");

0 commit comments

Comments
 (0)