Re: TLS Handshake failure

Mathias Spoerr <[email protected]> writes:

>thank you very much for your answer. I get the following error: "Server name
>'hostname.test.com' doesn't match host name '172.22.61.1' in server's
>certificate"
>
>When using the IP address instead of the DNS name it's working. How do I tell
>cryptlib to not care if the certificate is invalid?

Hmm, this kinda defeats the point of using a certificate, which is to verify
that the host that you're connecting to is the one that you're supposed to be
connecting to.  If you want to disable the checking you can set
CRYPT_SSLOPTION_DISABLE_NAMEVERIFY for the CRYPT_SESSINFO_SSL_OPTIONS
attribute, i.e.

cryptSetAttribute( cryptSession, CRYPT_SESSINFO_SSL_OPTIONS, CRYPT_SSLOPTION_DISABLE_NAMEVERIFY );

but this will then make you vulnerable to MITM attacks.

Peter.

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.