1


I am trying to verify a certificate using openssl. I verified the certificate chain itself and I want to check if the subject of the certificate matches the server name from the SSL field.
My code runs over the ssl sessions, First I want to extracted the server name from the packet (for this purpose I'm trying to use ssl.handshake.extensions_server_name field in tshark) and check it against the domains in the output of the command openssl x509 -text -noout cert.pem under the title: "X509v3 Subject Alternative Name".
It worked good on my test files, but while running the code on large file, it seems that there are ssl sessions that has no packet with the mentioned field (even though the browser didn't alert anything).
how can I still verify the name of the server ?

Note: I manually checked the "X509v3 Subject Alternative Name" of the certificate, and the names include the following list :
*.akamaihd.net, *.akamaihd-staging.net, a248.e.akamai.net, *.akamaized.net, *.akamaized-staging.net
Is it possible that my problem occurred because the names belongs to Akamai ? How can i solve the problem ?

Edit: The note isn't relevant, I checked the code on another file and I got the same problem with server that the certificate contains its name specifically. The question is - How is it possible that the server name is not included in the handshake? When such situation happens, how can i get a name that is supposed to be verified against the one in the certificate?
Thank you !

  • Is this on your own server? Are you trying to test how the server is configured? I think the question, “Is my server sending the right cert for a given SNI?” is a question of HTTP server configuration, not an issue with whether you generated your certs correctly. – Spiff Apr 27 '17 at 0:10
  • Actually I have a very large file of network traffic (.pcap file) and I'm trying to verify the certificates in it (It is not my server, and the file contains sessions with different server names and certs). I have just tried to run the code on another large file and I got the same problem but now the subject names of the certificate are different, which means that the problem is not with Akamai. So generally, how can i extract a server name from the traffic that i have to check against the subject name in the certificate? How is it possible that there isn't a server name in the handshake ? – usr371 Apr 27 '17 at 6:35
  • Because SSL doesn't require a server name for the handshake. It's why you had to have different IPs for different domains when SNI wasn't a thing as you could only deliver one cert per IP. So it might be that some of those connections are just from old devices/software that doesn't know about SNI. – Seth Apr 27 '17 at 9:08
  • Thank you for your answer, now I got it. But still, with no server names in the handshake, how can I verify the certificates ? I can't find any IP or other identifying field in the certificate that i can use for it. Here is a pastebin of the certificate in case I'm missing something: pastebin.com/QehLJjLX (please ignore the dates, the file is pretty old and all the verification process was done according to the capture date) – usr371 Apr 27 '17 at 9:26

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.