mirror of
https://github.com/vercel-labs/scriptc.git
synced 2026-11-08 08:44:37 +08:00
Chris Tate
9b9a54e71b
An https.request with servername: "" cleared the TLS hostname, which also turned off the certificate's name check, so a certificate for any other name passed verification. Node's empty servername only stops SNI from being sent; checkServerIdentity still checks the certificate against the request's host. The request now sends no SNI and the verify callback checks the leaf certificate against the host with mbedTLS's name rules, so a mismatch fails with ERR_TLS_CERT_ALTNAME_INVALID as it does without servername. Corpus 5654 covers an empty servername against a certificate for the host and one for another name, and the SNI names the server receives.