certificate-matches? ( host certificate -- ? )

Vocabulary

io.sockets.secure.openssl

Inputs

host	a string
certificate	an SSL peer certificate

Outputs

?

a boolean

Word description

Checks the certificate identity against a DNS name or IP address. DNS subject alternative names take precedence over the common name, and a wildcard matches one nonempty label. IP addresses must match an IP subject alternative name. Host names containing a null character are rejected. Uses equivalent local checks when the SSL library lacks native identity checking functions.

Definition

USING: io.encodings.string io.encodings.utf8
io.sockets.secure.openssl.private kernel namespaces openssl
openssl.libssl sequences ;

IN: io.sockets.secure.openssl

:: certificate-matches? ( host certificate -- ? )
    0 host member?
    [ f ] [
        ssl-native-identity-checks? get-global [
            host ip-host?
            [ certificate host 0 X509_check_ip_asc ] [
                certificate host host utf8 encode
                length X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS f
                X509_check_host
            ] if 1 =
        ] [ host certificate certificate-matches-legacy? ] if
    ] if ;