Search code examples
google-chromeopensslx509chromium

X509 subject alternative name (subjectAltName) IP address field


X509v3 can contain IP address field in subject Alternative Name extension.

  1. As an application verifying the server's identity, how should the IP address field be validated?
  2. If both DNS name and IP address are present? Is there a preference of one over the another?
  3. What is the use of dirName field?

Solution

  • I read RFC 2818 earlier but must have missed this part.

    In some cases, the URI is specified as an IP address rather than a
    hostname. In this case, the iPAddress subjectAltName must be present
    in the certificate and must exactly match the IP in the URI.