verify_certificate_identity relies on a naive string-based approach to extract DNS: (and IP:) entries from the subjectAltName extension. However, the SAN is truly an ASN.1 structure, and when the library stringifies it, otherName entries and semicolons (or other delimiters) will appear in the output. This leads to the regex split call misreading the line, causing verify_certificate_identity to fail on certificates that include otherName (common in Active Directory environments, for example).
For instance, a SAN might be stringified like:
"subjectAltName = critical, otherName:[1.3.6.1.4.1.311.20.2.3, [CONTEXT 0]HOST1$@example.com];DNS:host1.example.com, DNS:example.com, DNS:MYDOMAIN"
(See
|
if ( other ) val.append(';'); else val.append(',').append(' '); |
for where this happens?)
When split(/,\s+/) is applied to this string (see https://github.com/jruby/jruby-openssl/blob/976a3f5152b36129ad478175473bd63345286450/lib/openssl/ssl.rb#L273C9-L273C32), the returned array is
[
"subjectAltName = critical",
"otherName:[1.3.6.1.4.1.311.20.2.3",
"[CONTEXT 0]HOST1$@example.com];DNS:host1.example.com",
"DNS:example.com", "DNS:MYDOMAIN"
]
The DNS:host1.example.com entry will not be found and extracted by the regex in if /\ADNS:(.*)/ (https://github.com/jruby/jruby-openssl/blob/976a3f5152b36129ad478175473bd63345286450/lib/openssl/ssl.rb#L277C11-L277C26)
verify_certificate_identityrelies on a naive string-based approach to extractDNS:(andIP:) entries from the subjectAltName extension. However, the SAN is truly an ASN.1 structure, and when the library stringifies it,otherNameentries and semicolons (or other delimiters) will appear in the output. This leads to the regexsplitcall misreading the line, causingverify_certificate_identityto fail on certificates that includeotherName(common in Active Directory environments, for example).For instance, a SAN might be stringified like:
(See
jruby-openssl/src/main/java/org/jruby/ext/openssl/X509Extension.java
Line 518 in 976a3f5
When
split(/,\s+/)is applied to this string (see https://github.com/jruby/jruby-openssl/blob/976a3f5152b36129ad478175473bd63345286450/lib/openssl/ssl.rb#L273C9-L273C32), the returned array isThe
DNS:host1.example.comentry will not be found and extracted by the regex inif /\ADNS:(.*)/(https://github.com/jruby/jruby-openssl/blob/976a3f5152b36129ad478175473bd63345286450/lib/openssl/ssl.rb#L277C11-L277C26)