The logstash-forwarder and filebeat certificate validation will also check the server certificate domain name. For openssl this check must be done by the library user after connecting to a server.
For FQDN validation of server certificate the client should use the servers certificate after the handshake (connect) to search for the domain name in the X.509 extension fields with fallback to the commonName field. This check is required to prevent potential man-in-the middle attacks.
The ruby openssl module already provides post_connection_check. But post_connection_check must be called by developer.
It should be possible to disable this check for testing purposes.
The logstash-forwarder and filebeat certificate validation will also check the server certificate domain name. For openssl this check must be done by the library user after connecting to a server.
For FQDN validation of server certificate the client should use the servers certificate after the handshake (connect) to search for the domain name in the X.509 extension fields with fallback to the commonName field. This check is required to prevent potential man-in-the middle attacks.
The ruby openssl module already provides post_connection_check. But post_connection_check must be called by developer.
It should be possible to disable this check for testing purposes.