Support Subject Alternative Names in SSL server certificates

Enterprise / PostgreSQL - Heikki Linnakangas [iki.fi] - 12 September 2014 09:17 UTC

This patch makes libpq check the server's hostname against DNS names listed in the X509 subjectAltName extension field in the server certificate. This allows the same certificate to be used for multiple domain names. If there are no SANs in the certificate, the Common Name field is used, like before this patch. If both are given, the Common Name is ignored. That is a bit surprising, but that's the behavior mandated by the relevant RFCs, and it's also what the common web browsers do.

This also adds a libpq_ngettext helper macro to allow plural messages to be translated in libpq. Apparently this happened to be the first plural message in libpq, so it was not needed before.

Alexey Klyukin, with some kibitzing by me.

acd08d7 Support Subject Alternative Names in SSL server certificates.
src/interfaces/libpq/fe-misc.c | 18 ++-
src/interfaces/libpq/fe-secure-openssl.c | 238 +++++++++++++++++++++++-------
src/interfaces/libpq/libpq-int.h | 4 +
3 files changed, 202 insertions(+), 58 deletions(-)

Upstream: git.postgresql.org

  • Share