From 0625dbb0b96e2ecd557eb5bcdc458679123951db Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Tue, 15 Dec 2015 16:57:23 -0500 Subject: [PATCH] Document use of Subject Alternative Names in SSL server certificates. Commit acd08d764 did not bother with updating the documentation. --- doc/src/sgml/libpq.sgml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 9c0e4c8f9c..2328d8f5f2 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -7296,10 +7296,12 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*) - In verify-full mode, the cn (Common Name) attribute - of the certificate is matched against the host name. If the cn - attribute starts with an asterisk (*), it will be treated as - a wildcard, and will match all characters except a dot + In verify-full mode, the host name is matched against the + certificate's Subject Alternative Name attribute(s), or against the + Common Name attribute if no Subject Alternative Name of type dNSName is + present. If the certificate's name attribute starts with an asterisk + (*), the asterisk will be treated as + a wildcard, which will match all characters except a dot (.). This means the certificate will not match subdomains. If the connection is made using an IP address instead of a host name, the IP address will be matched (without doing any DNS lookups).