mbedTLS: BADCERT_CN_MISMATCH on https://1.1.1.1 with curl+mbedtls
Open
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 4.6k
- Forks
- 4k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 134
Description
Maintainer: @stangri
Environment: openwrt 22.03.2 raspberry pi 3 bcm2710
Description:
curl -V
curl 7.85.0 (aarch64-openwrt-linux-gnu) libcurl/7.85.0 mbedTLS/2.28.1 nghttp2/1.44.0
Release-Date: 2022-08-31
Protocols: file ftp ftps http https mqtt
Features: alt-svc HSTS HTTP2 IPv6 Largefile MultiSSL SSL threadsafe
opkg list-installed|grep curl
curl - 7.85.0-6.1
libcurl4 - 7.85.0-6.1
curl https://1.1.1.1/ -v
* Cert verify failed: BADCERT_CN_MISMATCH
curl: (60) Cert verify failed: BADCERT_CN_MISMATCH
More details here: https://curl.se/docs/sslcerts.html
note: https://one.one.one.one/ works. ubuntu with openssl works.
limited by mbedTLS?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported curl https://1.1.1.1/ failure in the stated OpenWrt 22.03.2, Raspberry Pi 3, and mbedTLS 2.28.1 environment, then compare it with https://one.one.one.one/ and an Ubuntu OpenSSL setup. Read the mbedTLS certificate hostname-verification behavior and determine whether the mismatch is expected or an OpenWrt package issue; done means the cause and supported resolution are established.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100