http://bugs.winehq.org/show_bug.cgi?id=60433 Bug ID: 60433 Summary: crypt32: SSL chain policy rejects certificates with an iPAddress subject alternative name Product: Wine Version: 11.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: crypt32 Assignee: wine-bugs@list.winehq.org Reporter: dhane1000@yahoo.com Target Milestone: --- Distribution: --- CertVerifyCertificateChainPolicy with CERT_CHAIN_POLICY_SSL fails with CERT_E_CN_NO_MATCH when the server name is an IP address and the certificate lists that address as an iPAddress subject alternative name. Windows accepts these certificates. Public CAs now issue such certificates, for example Let's Encrypt IP address certificates, and public services use them (https://1.1.1.1/). Steps to reproduce: 1. In a .NET Framework 4.8 program, make an HTTPS request to https://1.1.1.1/ (HttpWebRequest, with a ServerCertificateValidationCallback that prints the SslPolicyErrors). 2. Run it in Wine. Result in Wine: SslPolicyErrors = RemoteCertificateNameMismatch Result on Windows: SslPolicyErrors = None The chain itself is valid. A certificate for a DNS name, such as https://letsencrypt.org/, works in the same program. Cause: match_dns_to_subject_alt_name() in dlls/crypt32/chain.c only compares CERT_ALT_NAME_DNS_NAME entries. It skips CERT_ALT_NAME_IP_ADDRESS entries, so an IP address server name never matches. The subject DN fallback does not help, because these certificates have an empty subject. The code is the same in current master (wine-11.19). Expected behaviour: If the server name parses as an IPv4 or IPv6 address, compare its binary form with the iPAddress entries (4 or 16 bytes). Tested with: - wine-11.0 (Staging), Fedora 44 - Proton-CachyOS 11.0, GE-Proton 11, DW-Proton All fail the same way. Real application affected: the RO3 Asia game client logs in to a server by IP address with a Let's Encrypt IP certificate, and the login fails in Wine. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.