[Pkg-nagios-devel] Bug#742246: check_http: certificate check does not check if CN is correct

[Ralf G. R. Bergs]

Package: nagios-plugins-basic
Version: 1.4.16-1
Severity: normal

Dear Maintainer,

I use a call like follows to check the validity (expiry date) of my
certs:

check_http  -C 14 --ssl=1 --sni -H theDomain.de -I 1.2.3.4

I noticed that the above check does NOT compare the CN in the SSL
certificate to the hostname used with "-H". The check is basically
useless if you can deploy any (valid) certificate that does not match
the hostname indicated via SNI.

Thank you for looking into this.

KR,

Ralf


-- System Information:
Debian Release: 7.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 3.2.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages nagios-plugins-basic depends on:
ii  iputils-ping           3:20101006-1+b1
ii  libc6                  2.13-38+deb7u1
ii  libssl1.0.0            1.0.1e-2+deb7u4
ii  nagios-plugins-common  1.4.16-1
ii  procps                 1:3.3.3-3
ii  ucf                    3.0025+nmu3

nagios-plugins-basic recommends no packages.

Versions of packages nagios-plugins-basic suggests:
ii  nagios3  3.4.1-3+deb7u1

-- no debconf information