Hi,

Jef Gearhart <jef_at_tpssys.com> writes:

> Maybe this was intentional? If I try to use CURLOPT_SSL_VERIFYHOST
> (set to 2), but disable CURLOPT_SSL_VERIFYPEER, the connection
> succeeds, even though the Common name doesn't match the host name I
> connected to.
>
> I can see clearly in the code why this is so, but before I elaborate
> on that.. Is this intentional?

I think it is not (even if setting the former while unsetting the latter
seems pointless from a security standpoint).

During tests involving libcurl-gnutls, I had the expected behavior
(IIRC). Are you using the libssl-based version?

Cheers,

a+