From e116f11f0aeb740667294185534c859928dc125d Mon Sep 17 00:00:00 2001
From: Vladislav Vaintroub <wlad@mariadb.com>
Date: Wed, 24 Apr 2019 11:15:08 +0200
Subject: MDEV-18131 MariaDB does not verify IP addresses from subject
 alternative names

Added a call to X509_check_ip_asc() in case server_hostname represents
an IP address.
---
 mysql-test/lib/generate-ssl-certs.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'mysql-test/lib/generate-ssl-certs.sh')

diff --git a/mysql-test/lib/generate-ssl-certs.sh b/mysql-test/lib/generate-ssl-certs.sh
index 8f15ba9d521..4b333854c08 100755
--- a/mysql-test/lib/generate-ssl-certs.sh
+++ b/mysql-test/lib/generate-ssl-certs.sh
@@ -31,7 +31,7 @@ openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_
 
 # with SubjectAltName, only for OpenSSL 1.0.2+
 cat > demoCA/sanext.conf <<EOF
-subjectAltName=DNS:localhost
+subjectAltName=IP:127.0.0.1, DNS:localhost
 EOF
 openssl req -newkey rsa:1024 -keyout serversan-key.pem -out demoCA/serversan-req.pem -days 7300 -nodes -subj '/CN=server/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
 openssl ca -keyfile cakey.pem -extfile demoCA/sanext.conf -days 7300 -batch -cert cacert.pem -policy policy_anything -out serversan-cert.pem -infiles demoCA/serversan-req.pem
-- 
cgit v1.2.1