Set expected certificate hostname when connecting to an HTTPS server

2025-11-23 23:54:10 +01:00
parent 1be0c14415
commit aa158980f5
3 changed files with 31 additions and 5 deletions
@@ -465,8 +465,22 @@ static void socket_update(Socket *s)
                        else
                            addr = s->addr;

-                        if (addr.name)
+                        if (addr.name) {
+
+                            // Set expected hostname for verification
+                            if (SSL_set1_host(s->ssl, addr.name->data) != 1) {
+                                s->state = SOCKET_STATE_DIED;
+                                s->events = 0;
+                                break;
+                            }
+
+                            // Optional but recommended: be strict about wildcards
+                            SSL_set_hostflags(s->ssl,
+                                X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+
+                            // Also set for SNI (Server Name Indication)
                            SSL_set_tlsext_host_name(s->ssl, addr.name->data);
+                        }
                    }

                    int ret = SSL_connect(s->ssl);