Golang CertChecker hostname validation differs to OpenSSH

Adam Eijdenberg adam at continusec.com
Mon May 15 10:24:53 AEST 2017

Hi all,

Last week I noticed that the CertChecker in the Go implementation of
x/crypto/ssh seems to be doing host principal validation incorrectly
and filed the following bug:

By default they are looking for a principal named "host:port" inside
of the certificate presented by the server, instead of just looking
for the host as I believe OpenSSH does.

e.g. the following error is generated:

ssh: handshake failed: ssh: principal "localhost:2022" not in the set
of valid principals for given certificate: ["localhost"]

Before I ping the bug again, it would be good to get a second opinion
as to whether that behaviour is correct or not.

Cheers, Adam

More information about the openssh-unix-dev mailing list