master: 13fb91ac8cb8ddbce3fae64d59fd4ea6d300510e

master: 8048926bb07154a9fb1fe6676eceb9e14caedd05

To test, issue a client certificate with a Subject Alt Name extension and/or a server cert with one.

Configure a cgi-bin directory something like:

    <Directory "/home/rcrit/redhat/test/httpd/cgi-bin">
        NSSOptions +ExportCertData +CompatEnvVars +StdEnvVars
    </Directory>

I use this CGI to display the contents of the environment:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#!/usr/bin/perl
binmode(STDOUT);
binmode(STDIN);
print "Content-Type: text/plain\r\n";
print "\r\n";
foreach $key (sort (keys (%ENV))) {
    print "$key=$ENV{$key}\n";
}

So you can see the server-side SAN stuff just by hitting cgi-bin/<script-name>.

To see the client side add NSSVerifyClient require to the cgi-bin Directory and use the client cert you issued.

A default database is generated during install and that includes a server and client certs with SAN.

You should see lines like:

SSL_CLIENT_SAN_Email_0=alpha@foo.example.com
SSL_SERVER_SAN_DNS_0=foo.example.com