1
0
mirror of https://github.com/pgbackrest/pgbackrest.git synced 2025-10-30 23:37:45 +02:00

Improve error when hostname cannot be found in a certificate.

Update error message with the hostname and more detail about what went wrong.  Hopefully this will help in diagnosing certificate/hostname issues.

Suggested by James Badger.
This commit is contained in:
David Steele
2019-02-23 07:28:27 +02:00
parent 1f66bda02e
commit a9cbf23f4c
3 changed files with 21 additions and 2 deletions

View File

@@ -40,6 +40,16 @@
</release-item>
</release-bug-list>
<release-improvement-list>
<release-item>
<release-item-contributor-list>
<release-item-ideator id="james.badger"/>
</release-item-contributor-list>
<p>Improve error when hostname cannot be found in a certificate.</p>
</release-item>
</release-improvement-list>
<release-development-list>
<release-item>
<p>Migrate <cmd>remote</cmd> command to C.</p>
@@ -6419,6 +6429,11 @@
<contributor-id type="github">Edib</contributor-id>
</contributor>
<contributor id="james.badger">
<contributor-name-display>James Badger</contributor-name-display>
<contributor-id type="github">openfirmware</contributor-id>
</contributor>
<contributor id="james.chanco.jr">
<contributor-name-display>James Chanco Jr</contributor-name-display>
<contributor-id type="github">jameschancojr</contributor-id>

View File

@@ -402,7 +402,11 @@ tlsClientOpen(TlsClient *this)
X509_free(certificate);
if (!nameResult)
THROW(CryptoError, "unable to find matching hostname in certificate");
{
THROW_FMT(
CryptoError,
"unable to find hostname '%s' in certificate common name or subject alternative names", strPtr(this->host));
}
}
MEM_CONTEXT_BEGIN(this->memContext)

View File

@@ -161,7 +161,7 @@ testRun(void)
tlsClientOpen(
tlsClientNew(strNew("test3.pgbackrest.org"), 9443, 500, true,
strNewFmt("%s/" TEST_CERTIFICATE_PREFIX "-ca.crt", testRepoPath()), NULL)),
CryptoError, "unable to find matching hostname in certificate");
CryptoError, "unable to find hostname 'test3.pgbackrest.org' in certificate common name or subject alternative names");
TEST_ERROR(
tlsClientOpen(