{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/bugs/issues/1513","repository_url":"https://api.github.com/repos/coreos/bugs","labels_url":"https://api.github.com/repos/coreos/bugs/issues/1513/labels{/name}","comments_url":"https://api.github.com/repos/coreos/bugs/issues/1513/comments","events_url":"https://api.github.com/repos/coreos/bugs/issues/1513/events","html_url":"https://github.com/coreos/bugs/issues/1513","id":170592859,"number":1513,"title":"curl does not correctly verify HTTPS server IP against TLS certificate with IP SANs","user":{"login":"omkensey","id":8946309,"avatar_url":"https://avatars.githubusercontent.com/u/8946309?v=3","gravatar_id":"","url":"https://api.github.com/users/omkensey","html_url":"https://github.com/omkensey","followers_url":"https://api.github.com/users/omkensey/followers","following_url":"https://api.github.com/users/omkensey/following{/other_user}","gists_url":"https://api.github.com/users/omkensey/gists{/gist_id}","starred_url":"https://api.github.com/users/omkensey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/omkensey/subscriptions","organizations_url":"https://api.github.com/users/omkensey/orgs","repos_url":"https://api.github.com/users/omkensey/repos","events_url":"https://api.github.com/users/omkensey/events{/privacy}","received_events_url":"https://api.github.com/users/omkensey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-08-11T08:21:14Z","updated_at":"2016-08-13T06:57:28Z","closed_at":null,"body":"# Issue Report #\r\n\r\n## Bug ##\r\n\r\ncurl in the current stable version seems to be overly-strict in its verification of TLS certificates.  I'm running the GCE self-hosted Kubernetes quickstart and when I try to run the init-worker.sh, the script dies with this error:\r\n\r\ncurl: (51) SSL: no alternative certificate subject name matches target host name '[API server public IP]'\r\n\r\nHowever, dumping the TLS certificate using openssl s_client shows that the IP is in the SAN list.  Running curl manually with the -v option shows this at the critical point:\r\n\r\n*  subjectAltName: host \"[API server public IP]\" matched cert's IP address!\r\n*  subjectAltName does not match [API server public IP]\r\n* SSL: no alternative certificate subject name matches target host name '[API server public IP]'\r\n* Closing connection 0\r\n* TLSv1.2 (OUT), TLS alert, Client hello (1):\r\ncurl: (51) SSL: no alternative certificate subject name matches target host name '[API server public IP]'\r\n\r\nHowever, querying the same URL using the same set of TLS assets on a different host (a Google Cloud Shell instance) successfully connects to the API server over TLS with an older version of curl:\r\n\r\n```\r\n$ curl -V\r\ncurl 7.38.0 (x86_64-pc-linux-gnu) libcurl/7.38.0 OpenSSL/1.0.1t zlib/1.2.8 libidn/1.29 libssh2/1.4.3 librtmp/2.3\r\nProtocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp \r\nFeatures: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL libz TLS-SRP \r\n```\r\n\r\n### CoreOS Version ###\r\n\r\n```\r\n$ cat /etc/os-release\r\nNAME=CoreOS\r\nID=coreos\r\nVERSION=1068.9.0\r\nVERSION_ID=1068.9.0\r\nBUILD_ID=2016-08-05-0455\r\nPRETTY_NAME=\"CoreOS 1068.9.0 (MoreOS)\"\r\nANSI_COLOR=\"1;32\"\r\nHOME_URL=\"https://coreos.com/\"\r\nBUG_REPORT_URL=\"https://github.com/coreos/bugs/issues\"\r\n```\r\n\r\n### Environment ###\r\n\r\nGCE\r\n\r\n### Expected Behavior ###\r\n\r\ncurl properly verifies the TLS cert offered by the server and completes the request.\r\n\r\n### Actual Behavior ###\r\n\r\ncurl fails with error:\r\n\r\ncurl: (51) SSL: no alternative certificate subject name matches target host name '[API server public IP]'\r\n\r\n### Reproduction Steps ###\r\n\r\n  1. Using the latest release of bootkube, set up a Kubernetes master on GCE\r\n  2. Run the init-worker.sh script to try to initialize a worker (the TLS assets will be copied to the worker before the script dies).\r\n\r\n### Other Information ###\r\n\r\nI think this either is, or is related to, https://github.com/curl/curl/issues/875"},"comment":{"url":"https://api.github.com/repos/coreos/bugs/issues/comments/239606439","html_url":"https://github.com/coreos/bugs/issues/1513#issuecomment-239606439","issue_url":"https://api.github.com/repos/coreos/bugs/issues/1513","id":239606439,"user":{"login":"mischief","id":1487996,"avatar_url":"https://avatars.githubusercontent.com/u/1487996?v=3","gravatar_id":"","url":"https://api.github.com/users/mischief","html_url":"https://github.com/mischief","followers_url":"https://api.github.com/users/mischief/followers","following_url":"https://api.github.com/users/mischief/following{/other_user}","gists_url":"https://api.github.com/users/mischief/gists{/gist_id}","starred_url":"https://api.github.com/users/mischief/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mischief/subscriptions","organizations_url":"https://api.github.com/users/mischief/orgs","repos_url":"https://api.github.com/users/mischief/repos","events_url":"https://api.github.com/users/mischief/events{/privacy}","received_events_url":"https://api.github.com/users/mischief/received_events","type":"User","site_admin":false},"created_at":"2016-08-13T06:57:27Z","updated_at":"2016-08-13T06:57:27Z","body":"thanks for the update! :snowman: "}}
{"actor":{"display_login":"mischief"}}