{"action":"created","issue":{"url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/459","repository_url":"https://api.github.com/repos/anthonycr/Lightning-Browser","labels_url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/459/labels{/name}","comments_url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/459/comments","events_url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/459/events","html_url":"https://github.com/anthonycr/Lightning-Browser/issues/459","id":174639112,"number":459,"title":"Proper validation of https Certificate Subject Alt Name","user":{"login":"jroldroyd","id":3521041,"avatar_url":"https://avatars.githubusercontent.com/u/3521041?v=3","gravatar_id":"","url":"https://api.github.com/users/jroldroyd","html_url":"https://github.com/jroldroyd","followers_url":"https://api.github.com/users/jroldroyd/followers","following_url":"https://api.github.com/users/jroldroyd/following{/other_user}","gists_url":"https://api.github.com/users/jroldroyd/gists{/gist_id}","starred_url":"https://api.github.com/users/jroldroyd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroldroyd/subscriptions","organizations_url":"https://api.github.com/users/jroldroyd/orgs","repos_url":"https://api.github.com/users/jroldroyd/repos","events_url":"https://api.github.com/users/jroldroyd/events{/privacy}","received_events_url":"https://api.github.com/users/jroldroyd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-01T22:17:54Z","updated_at":"2016-09-02T15:17:39Z","closed_at":null,"body":"I have started to see numerous warnings when visiting various different https web sites:\r\n\r\n> Warning: Connection to this site is not secure: - domain in certificate does not match the site domain.\r\n\r\nLooking at the certificate in firefox, I see I am visiting sites that are hosted at a hosting company.  The certificate has a Certificate Subject Alt Name which contains a list of DNS Names that includes the domain for the \"site_I_am_visiting.com\", as well as the wildcard \"*.site_I_am_visiting.com\".  But the actual certificate name is for the hosting company.\r\n\r\nAn example where you will see this is [https://theguardian.com/](url).\r\n\r\nPerhaps the certificate validation code needs updating?  Or a library needs updating?  Or does some flag need to be used to also verify against Subject Alt Name?"},"comment":{"url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/comments/244404607","html_url":"https://github.com/anthonycr/Lightning-Browser/issues/459#issuecomment-244404607","issue_url":"https://api.github.com/repos/anthonycr/Lightning-Browser/issues/459","id":244404607,"user":{"login":"jroldroyd","id":3521041,"avatar_url":"https://avatars.githubusercontent.com/u/3521041?v=3","gravatar_id":"","url":"https://api.github.com/users/jroldroyd","html_url":"https://github.com/jroldroyd","followers_url":"https://api.github.com/users/jroldroyd/followers","following_url":"https://api.github.com/users/jroldroyd/following{/other_user}","gists_url":"https://api.github.com/users/jroldroyd/gists{/gist_id}","starred_url":"https://api.github.com/users/jroldroyd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jroldroyd/subscriptions","organizations_url":"https://api.github.com/users/jroldroyd/orgs","repos_url":"https://api.github.com/users/jroldroyd/repos","events_url":"https://api.github.com/users/jroldroyd/events{/privacy}","received_events_url":"https://api.github.com/users/jroldroyd/received_events","type":"User","site_admin":false},"created_at":"2016-09-02T15:17:38Z","updated_at":"2016-09-02T15:17:38Z","body":"Interesting that it is not a problem for you.\r\n\r\nAnother example for me is [https://m.washingtonpost.com/](url).  Also hosted, also has the \"*.washintonpost.com\" domain listed in a Subject Alt Name field.\r\n\r\nAnd another is [https://www.wunderground.com/](url).  In this one, the Cert Name is \"\\*.wunderground.com\" and the Subject Alt Name field is also \"*.wunderground.com\".\r\n\r\nMy phone is a Samsung S7 Edge, not-rooted, running stock, up-to-date firmware.  I am also seeing the same problem on a Moto X 2015 Pure, also not-rooted, stock, up-to-date.\r\n\r\nI do not see the problem when I use the Firefox browser on the phone.\r\n\r\nSeeing this on two different vendors' phones and not in Firefox is what led me to conclude that this is a Lightning-specific issue.\r\n\r\nBased on your not having this problem on CM13, maybe this is to do with Lightning's use of the stock SSL libraries?  Maybe Firefox uses different SSL libraries?  If that's the case, what does Lightning need to do to avoid this error/warning?"}}
{"actor":{"display_login":"jroldroyd"}}