Using Common Name in certificates

Adnan Maolood me at adnano.co
Tue Nov 3 01:47:43 GMT 2020


The documentation for the Go crypto/tls package has this to say about
using the Common Name field in certificates:

>  The legacy Common Name field is ignored unless it's a valid hostname,
>  the certificate doesn't have any Subject Alternative Names, and the
>  GODEBUG environment variable is set to "x509ignoreCN=0". Support for
>  Common Name is deprecated will be entirely removed in the future.

https://golang.org/pkg/crypto/x509/#Certificate.VerifyHostname

In light of this, should Gemini servers avoid using the Common Name for
certificates, or at least provide a Subject Alternative Name as well?
For go-gemini I had to vendor in the hostname verification code from
crypto/tls and modify it to accept common names without setting the
GODEBUG environment variable.


More information about the Gemini mailing list