{"action":"created","issue":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/489","repository_url":"https://api.github.com/repos/ssllabs/ssllabs-scan","labels_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/489/labels{/name}","comments_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/489/comments","events_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/489/events","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/489","id":224375044,"number":489,"title":"Invalid Common Name when CN contains additional data","user":{"login":"stefanb","id":319826,"avatar_url":"https://avatars3.githubusercontent.com/u/319826?v=3","gravatar_id":"","url":"https://api.github.com/users/stefanb","html_url":"https://github.com/stefanb","followers_url":"https://api.github.com/users/stefanb/followers","following_url":"https://api.github.com/users/stefanb/following{/other_user}","gists_url":"https://api.github.com/users/stefanb/gists{/gist_id}","starred_url":"https://api.github.com/users/stefanb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stefanb/subscriptions","organizations_url":"https://api.github.com/users/stefanb/orgs","repos_url":"https://api.github.com/users/stefanb/repos","events_url":"https://api.github.com/users/stefanb/events{/privacy}","received_events_url":"https://api.github.com/users/stefanb/received_events","type":"User","site_admin":false},"labels":[{"id":137690450,"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/labels/bug","name":"bug","color":"fc2929","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-04-26T07:51:24Z","updated_at":"2017-05-25T13:21:16Z","closed_at":"2017-05-11T11:34:11Z","body":"https://www.ssllabs.com/ssltest/analyze.html?d=ecrp.gov.si\r\nimmediately reports:\r\n\r\n> Certificate name mismatch\r\n\r\nThen, after ignoring mismatch and the test is finished it reports:\r\n\r\n> Common names\t-   INVALID\r\n\r\nYet the site can be normally used (after trusting the national CA).\r\n\r\nInvestigation with OpenSsl shows:\r\n```\r\n$  echo | openssl s_client -showcerts -connect ecrp.gov.si:443 2>/dev/null | openssl x509 -text\r\nCertificate:\r\n    Data:\r\n        Version: 3 (0x2)\r\n        Serial Number: 2895611744 (0xac978760)\r\n        Signature Algorithm: sha1WithRSAEncryption\r\n        Issuer: C=si, O=state-institutions, OU=sigov-ca\r\n        Validity\r\n            Not Before: Nov 25 08:50:16 2013 GMT\r\n            Not After : Nov 25 16:37:54 2018 GMT\r\n        Subject: C=si, O=state-institutions, OU=web-certificates, OU=Servers, CN=ecrp.gov.si/serialNumber=1235603710028\r\n        Subject Public Key Info:\r\n            Public Key Algorithm: rsaEncryption\r\n            RSA Public Key: (2048 bit)\r\n                Modulus (2048 bit):\r\n                    00:cd:7d:09:10:e0:c9:c5:47:01:24:74:95:84:2c:\r\n                    09:86:a8:c9:75:b3:46:7d:84:94:92:13:5c:32:fd:\r\n                    b7:b5:2c:21:3c:a2:1b:e0:57:60:fb:8d:57:a2:cc:\r\n                    3b:4d:69:f2:f6:ce:e3:3f:f8:37:f2:3b:37:a1:5d:\r\n                    54:00:d3:8b:64:ad:64:64:c6:b9:34:3b:fc:7a:37:\r\n                    23:27:54:cf:23:ef:ae:1b:b3:37:45:ac:0a:56:68:\r\n                    65:7b:cf:70:24:da:ef:66:66:ab:dd:45:df:3f:9c:\r\n                    d5:77:e3:71:46:aa:6b:35:cb:fa:ce:b3:40:0a:eb:\r\n                    68:25:14:d9:88:30:5c:f2:c0:8e:e1:fb:70:d3:4e:\r\n                    41:ec:25:3e:7f:b9:87:ca:b3:d1:85:22:35:5c:d5:\r\n                    18:0e:0a:4a:78:76:87:6d:b1:d9:ff:47:8d:5d:41:\r\n                    44:66:03:06:ac:b1:cb:50:e3:ff:fd:22:9e:94:a0:\r\n                    30:27:b5:7c:40:8a:de:39:35:93:c5:26:e8:16:d1:\r\n                    b1:bd:5e:ea:37:c4:21:7b:e4:21:05:a7:0b:cf:f5:\r\n                    5c:44:a4:8f:d1:e7:87:8d:5e:f1:23:9c:96:0c:5e:\r\n                    a2:df:e0:bd:ac:36:6b:e0:01:60:ef:13:c0:6e:56:\r\n                    d8:5c:2f:8a:42:fe:40:4a:68:14:8f:c1:bb:e4:64:\r\n                    5c:67\r\n                Exponent: 65537 (0x10001)\r\n        X509v3 extensions:\r\n            X509v3 Key Usage: critical\r\n                Digital Signature, Key Encipherment\r\n            X509v3 Certificate Policies: \r\n                Policy: 1.3.6.1.4.1.6105.1.3.3\r\n                  CPS: http://www.ca.gov.si/cps/\r\n\r\n            X509v3 Subject Alternative Name: \r\n                email:certifikati@3gen.si\r\n            X509v3 CRL Distribution Points: \r\n                DirName:/C=si/O=state-institutions/OU=sigov-ca/CN=CRL44\r\n                URI:ldap://x500.gov.si/ou=sigov-ca,o=state-institutions,c=si?certificateRevocationList?base\r\n                URI:http://www.sigov-ca.gov.si/crl/sigov-ca.crl\r\n\r\n            X509v3 Private Key Usage Period: \r\n                Not Before: Nov 25 08:50:16 2013 GMT, Not After: Nov 25 16:37:54 2018 GMT\r\n            X509v3 Authority Key Identifier: \r\n                keyid:1E:F8:D4:53:6B:B3:83:06:E9:04:06:57:02:F9:A5:BF:C6:58:3C:72\r\n\r\n            X509v3 Subject Key Identifier: \r\n                77:96:A0:09:5B:C1:F2:19:23:B5:6E:36:E6:AB:F5:7F:E8:6D:07:E1\r\n            X509v3 Basic Constraints: \r\n                CA:FALSE\r\n            1.2.840.113533.7.65.0: \r\n                0\r\n..V8.1....\r\n    Signature Algorithm: sha1WithRSAEncryption\r\n        a8:d6:bc:de:7f:95:c9:63:d0:4c:cc:80:73:78:16:3a:e8:e0:\r\n        63:bf:fa:ba:2d:ec:78:69:61:eb:9a:3e:a0:b5:fd:37:3f:91:\r\n        2f:96:73:be:7f:4a:e3:f0:b3:e1:26:8f:80:18:43:78:e5:7a:\r\n        bd:ee:97:16:fd:0f:3a:e5:74:91:93:97:94:d0:33:2d:2e:a7:\r\n        35:2e:10:76:f9:11:4b:9d:0f:a3:1e:67:4a:7d:12:db:2f:f3:\r\n        af:4b:d7:10:02:72:8d:40:c6:63:f0:16:7c:8f:e4:7c:09:d3:\r\n        d9:1d:96:19:af:d2:15:6a:18:16:69:33:97:86:88:0c:2c:d3:\r\n        40:54:77:c0:37:2f:cb:78:2e:d6:bb:a1:88:9e:ce:27:4e:2b:\r\n        67:98:87:b0:22:79:b4:38:49:54:c1:62:19:1d:60:cc:50:1b:\r\n        5b:08:f7:b5:7e:75:20:38:db:75:68:f5:74:4f:f8:5a:9a:8a:\r\n        91:eb:3b:80:0e:32:db:3d:05:e6:bc:44:a3:ed:f9:61:91:a1:\r\n        f8:e1:9d:ad:da:02:07:d9:f7:bc:91:c2:ee:61:de:3b:b1:e5:\r\n        70:8e:f3:e6:ee:d6:92:8c:4e:93:74:e9:bb:b5:c9:c5:5e:f0:\r\n        f0:87:4d:82:22:31:51:cb:97:e5:76:b6:ca:31:11:95:4f:9d:\r\n        38:ae:ab:48\r\n-----BEGIN CERTIFICATE-----\r\nMIIFPzCCBCegAwIBAgIFAKyXh2AwDQYJKoZIhvcNAQEFBQAwPTELMAkGA1UEBhMC\r\nc2kxGzAZBgNVBAoTEnN0YXRlLWluc3RpdHV0aW9uczERMA8GA1UECxMIc2lnb3Yt\r\nY2EwHhcNMTMxMTI1MDg1MDE2WhcNMTgxMTI1MTYzNzU0WjCBgzELMAkGA1UEBhMC\r\nc2kxGzAZBgNVBAoTEnN0YXRlLWluc3RpdHV0aW9uczEZMBcGA1UECxMQd2ViLWNl\r\ncnRpZmljYXRlczEQMA4GA1UECxMHU2VydmVyczEqMBIGA1UEAxMLZWNycC5nb3Yu\r\nc2kwFAYDVQQFEw0xMjM1NjAzNzEwMDI4MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A\r\nMIIBCgKCAQEAzX0JEODJxUcBJHSVhCwJhqjJdbNGfYSUkhNcMv23tSwhPKIb4Fdg\r\n+41Xosw7TWny9s7jP/g38js3oV1UANOLZK1kZMa5NDv8ejcjJ1TPI++uG7M3RawK\r\nVmhle89wJNrvZmar3UXfP5zVd+NxRqprNcv6zrNACutoJRTZiDBc8sCO4ftw005B\r\n7CU+f7mHyrPRhSI1XNUYDgpKeHaHbbHZ/0eNXUFEZgMGrLHLUOP//SKelKAwJ7V8\r\nQIreOTWTxSboFtGxvV7qN8Qhe+QhBacLz/VcRKSP0eeHjV7xI5yWDF6i3+C9rDZr\r\n4AFg7xPAblbYXC+KQv5ASmgUj8G75GRcZwIDAQABo4IB/TCCAfkwDgYDVR0PAQH/\r\nBAQDAgWgMEAGA1UdIAQ5MDcwNQYKKwYBBAGvWQEDAzAnMCUGCCsGAQUFBwIBFhlo\r\ndHRwOi8vd3d3LmNhLmdvdi5zaS9jcHMvMB4GA1UdEQQXMBWBE2NlcnRpZmlrYXRp\r\nQDNnZW4uc2kwgfEGA1UdHwSB6TCB5jBVoFOgUaRPME0xCzAJBgNVBAYTAnNpMRsw\r\nGQYDVQQKExJzdGF0ZS1pbnN0aXR1dGlvbnMxETAPBgNVBAsTCHNpZ292LWNhMQ4w\r\nDAYDVQQDEwVDUkw0NDCBjKCBiaCBhoZXbGRhcDovL3g1MDAuZ292LnNpL291PXNp\r\nZ292LWNhLG89c3RhdGUtaW5zdGl0dXRpb25zLGM9c2k/Y2VydGlmaWNhdGVSZXZv\r\nY2F0aW9uTGlzdD9iYXNlhitodHRwOi8vd3d3LnNpZ292LWNhLmdvdi5zaS9jcmwv\r\nc2lnb3YtY2EuY3JsMCsGA1UdEAQkMCKADzIwMTMxMTI1MDg1MDE2WoEPMjAxODEx\r\nMjUxNjM3NTRaMB8GA1UdIwQYMBaAFB741FNrs4MG6QQGVwL5pb/GWDxyMB0GA1Ud\r\nDgQWBBR3lqAJW8HyGSO1bjbmq/V/6G0H4TAJBgNVHRMEAjAAMBkGCSqGSIb2fQdB\r\nAAQMMAobBFY4LjEDAgOoMA0GCSqGSIb3DQEBBQUAA4IBAQCo1rzef5XJY9BMzIBz\r\neBY66OBjv/q6Lex4aWHrmj6gtf03P5EvlnO+f0rj8LPhJo+AGEN45Xq97pcW/Q86\r\n5XSRk5eU0DMtLqc1LhB2+RFLnQ+jHmdKfRLbL/OvS9cQAnKNQMZj8BZ8j+R8CdPZ\r\nHZYZr9IVahgWaTOXhogMLNNAVHfANy/LeC7Wu6GIns4nTitnmIewInm0OElUwWIZ\r\nHWDMUBtbCPe1fnUgONt1aPV0T/hamoqR6zuADjLbPQXmvESj7flhkaH44Z2t2gIH\r\n2fe8kcLuYd47seVwjvPm7taSjE6TdOm7tcnFXvDwh02CIjFRy5fldrbKMRGVT504\r\nrqtI\r\n-----END CERTIFICATE-----\r\n```\r\n\r\nI suspect the problem is either:\r\n* parsing the unusual subject DN: `C=si, O=state-institutions, OU=web-certificates, OU=Servers, CN=ecrp.gov.si/serialNumber=1235603710028`, which seems to be including additional data in the `CN` attribute or\r\n* Subject Alternative Name  (`SubjectAltName`) containing only an email, and no DNS name entires\r\n\r\nCertificate interpretation in Firefox:\r\n![image](https://cloud.githubusercontent.com/assets/319826/25435055/10c74086-2a8f-11e7-8399-9c9562adbd2f.png)\r\n\r\n\r\n(I am not affiliated with that site, just a user)"},"comment":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/comments/304008439","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/489#issuecomment-304008439","issue_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/489","id":304008439,"user":{"login":"bhushan5640","id":6083185,"avatar_url":"https://avatars1.githubusercontent.com/u/6083185?v=3","gravatar_id":"","url":"https://api.github.com/users/bhushan5640","html_url":"https://github.com/bhushan5640","followers_url":"https://api.github.com/users/bhushan5640/followers","following_url":"https://api.github.com/users/bhushan5640/following{/other_user}","gists_url":"https://api.github.com/users/bhushan5640/gists{/gist_id}","starred_url":"https://api.github.com/users/bhushan5640/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bhushan5640/subscriptions","organizations_url":"https://api.github.com/users/bhushan5640/orgs","repos_url":"https://api.github.com/users/bhushan5640/repos","events_url":"https://api.github.com/users/bhushan5640/events{/privacy}","received_events_url":"https://api.github.com/users/bhushan5640/received_events","type":"User","site_admin":false},"created_at":"2017-05-25T13:21:16Z","updated_at":"2017-05-25T13:21:16Z","body":"This is due to the following change\r\nhttps://github.com/ssllabs/ssllabs-scan/issues/486"}}
{"actor":{"display_login":"bhushan5640"}}