Golang CertChecker hostname validation differs to OpenSSH

Adam Eijdenberg adam at continusec.com
Mon May 15 19:01:14 AEST 2017

On Mon, May 15, 2017 at 11:39 AM, Peter Moody <mindrot at hda3.com> wrote:
> my reading of the sshd manpage is that ssh is more permissive than it should be
>   ...
>   A hostname or address may optionally be enclosed within `[' and `]'
> brackets then followed by `:' and a non-standard port number.

Hi Peter, I'm not sure that quite answers the same question.

ie at one level there is a decision that is made about whether a line
in the known hosts file should be evaluated for a given host/port -
and I think that's what you are referring to above.

However once a line from known hosts is allowed for evaluation for a
host/port, there's a second matter of checking whether the certificate
presented contains the appropriate principal.

I think this what "check_host_cert()" does, and as far as I can tell,
OpenSSH only passes it the hostname (not "host:port"). See:

(for better or for worse, this would be roughly inline with X.509v3
cert host matching, which also doesn't match on port numbers)

More information about the openssh-unix-dev mailing list