Skip to content

Implemented custom SNI server name #1582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from

Conversation

fpagliughi
Copy link
Contributor

This implements #1580, to provide an optional, separate SNI server name.

It adds a new const char* serverName parameter to the SSL options. If it is non-NULL, then it is used for SNI validation, otherwise the host name is used. Thus the new capability is opt-in, and defaults to the previous implementation if not provided, and therefore is completely backward compatible.

@fpagliughi fpagliughi force-pushed the custom-sni-validation branch from 1a9ca71 to edf5f76 Compare March 1, 2025 15:49
@fpagliughi
Copy link
Contributor Author

fpagliughi commented Mar 1, 2025

It took two tries, but this appears to be working now and passing all the unit tests.

The simplest test for this is to use the IP address in the URL and then set the serverName in the SSL options to the host name, and verify enabled like:

URL -> mqtts://5.196.78.28:8886
serverName -> test.mosquitto.org
verify -> 1

A thing to note is that this only allows for providing a single server name, even when using High Availability with multiple URLs. If you omit the server name, each host name will be derived from the URL, just like before, but if you do add a server name, all addresses will verify to that name.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant