proxy_ssl_verify does not support iPAddress subjectAlternativeName

[gavriluk@…]

Module ngx_http_proxy_module proxy_ssl_trusted_certificate ignores x509 extension ipAddress

location config:
proxy_pass ​https://10.10.10.10:8443;
proxy_ssl_certificate /nginx/certs/chain.pem;
proxy_ssl_certificate_key /nginx/certs/client.key;
proxy_ssl_trusted_certificate /nginx/certs/proxied_server.pem;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;

When specifies
proxy_pass ​https://10.10.10.10:8443;
there is an error in error.log and 502 Bad gateway in curl

2021/03/09 23:22:34 [error] 18566#0: *1 upstream SSL certificate does not match "10.10.10.10" while SSL handshaking to upstream, client: 127.0.0.1, server: localhost, request: "GET / HTTP/1.1", upstream: "​https://10.10.10.10:8443/", host: "localhost"

but when specifies
proxy_pass ​https://somehost:8443;
then it works

certificate:
$> openssl x509 -text -in /nginx/certs/proxied_server.pem
...
X509v3 Subject Alternative Name:

DNS:somehost, IP Address:10.10.10.10

...

[Maxim Dounin]

As of now, proxy_ssl_verify does not try to check IP addresses, but only supports DNS names. Given that use of IP addresses in certificates becomes more common, it probably make sense to add support for iPAddress subjectAlternativeName in addition to dNSName.

For the reference, ​RFC 2818 says:

In some cases, the URI is specified as an IP address rather than a
hostname. In this case, the iPAddress subjectAltName must be present
in the certificate and must exactly match the IP in the URI.

In ​RFC 6125, identifiers other than fully qualified DNS domain names are explicitly listed as out of scope.

There seems to be some recent development towards proper validation of IP addresses by public authorities. In particular, recently published ​RFC 8738 defines a way to automatically validate IP addresses in ACME, and it seems that Let’s Encrypt might have ​some ​plans to implement this.

Known public services with iPAddress subject altnames include 1.1.1.1 and 8.8.8.8:

            X509v3 Subject Alternative Name: 
                DNS:cloudflare-dns.com, DNS:*.cloudflare-dns.com, DNS:one.one.one.one, IP Address:1.1.1.1, IP Address:1.0.0.1, IP Address:162.159.36.1, IP Address:162.159.46.1, IP Address:2606:4700:4700:0:0:0:0:1111, IP Address:2606:4700:4700:0:0:0:0:1001, IP Address:2606:4700:4700:0:0:0:0:64, IP Address:2606:4700:4700:0:0:0:0:6400

            X509v3 Subject Alternative Name: 
                DNS:dns.google, DNS:*.dns.google.com, DNS:8888.google, DNS:dns.google.com, DNS:dns64.dns.google, IP Address:2001:4860:4860:0:0:0:0:64, IP Address:2001:4860:4860:0:0:0:0:6464, IP Address:2001:4860:4860:0:0:0:0:8844, IP Address:2001:4860:4860:0:0:0:0:8888, IP Address:8.8.4.4, IP Address:8.8.8.8

A previous attempt to implement this can be seen ​here (certainly needs more work).

[gavriluk@…]

blocks https://trac.nginx.org/nginx/ticket/2157