gnutls_x509_crt_check_hostname2(3)

💖 gnutls_x509_crt_check_hostname2(3) 💖

okay bestie, welcome to the gnutls manual, and today's main character is gnutls_x509_crt_check_hostname2 — she's an API function and she's here to tell you whether a certificate actually belongs to the hostname you think it does. no cap. 🌸

---

✨ NAME ✨

gnutls_x509_crt_check_hostname2 — API function, certified hostname-checker, iconic behavior only 💅

---

🦋 SYNOPSIS 🦋

#include <gnutls/x509.h>

unsigned gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert, const
char * hostname, unsigned int flags);

---

🎀 ARGUMENTS 🎀

• gnutls_x509_crt_t cert — should contain an gnutls_x509_crt_t type. that's the cert we're interrogating, she's on the stand 🫶
• const char * hostname — a null terminated string that contains a DNS name. yes, null terminated, don't play games with her 🙈
• unsigned int flags — these are gnutls_certificate_verify_flags. the little switches that change how strict she is ✨

---

🌈 DESCRIPTION 🌈

so here's the tea: this function checks if the given certificate's subject matches the given hostname. it's a basic implementation of the matching described in RFC6125, and it takes into account wildcards, plus the DNSName/IPAddress subject alternative name PKIX extension. she knows her lore fr fr 📜

IPv4 addresses are accepted by this function in the dotted-decimal format (e.g, ddd.ddd.ddd.ddd), and IPv6 addresses in the hexadecimal x:x:x:x:x:x:x:x format. for those, the IPAddress subject alternative name extension is what gets consulted — no side-eyeing the other fields. and listen: previous versions to 3.6.0 of GnuTLS, in the case of a non-match, would consult (in a non-standard extension) the DNSname and CN fields. this is no longer the case. glow-up happened, the old behavior is gone, periodt 💀

when the flag GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS is specified, no wildcards are considered, at all, zero, nada. otherwise they're only considered if the domain name consists of three components or more, and the wildcard starts at the leftmost position. very specific, very demure 🎀

when the flag GNUTLS_VERIFY_DO_NOT_ALLOW_IP_MATCHES is specified, the input will be treated as a DNS name, and matching of textual IP addresses against the IPAddress part of the alternative name will not be allowed. so like, don't come in here pretending to be an IP if you're not allowed, bestie 🚫

and if you're actually here for IP matching? the function gnutls_x509_crt_check_ip() is available for matching IP addresses. she's the specialist, go talk to her 🦋

---

👑 RETURNS 👑

non-zero for a successful match, and zero on failure. slay = truthy, fail = falsy. iconic ✨

---

⭐ SINCE ⭐

3.3.0 — she's been around a minute, she's a legend 🫶

---

🙈 REPORTING BUGS 🙈

Report bugs to <bugs@gnutls.org>.

Home page: https://www.gnutls.org

---

💜 COPYRIGHT 💜

Copyright © 2001-2023 Free Software Foundation, Inc., and others.

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. so like, keep the receipts, bestie 🧾✨

---

🌸 SEE ALSO 🌸

The full documentation for gnutls is maintained as a Texinfo manual. If the /usr/share/doc/gnutls/ directory does not contain the HTML form visit

https://www.gnutls.org/manual/

---

okay that's the whole page, you ate it, no crumbs 💅 this was gnutls 3.8.13 energy, from the gnutls crew, and honestly? she's giving certified, verified, hostname-matched main character. go forth and validate, bestie 🎀🦋💖