mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-06-10 08:37:15 +00:00
fa981cedae
For connections to IP-literal hosts with server certificate verification enabled, the Mbed TLS and wolfSSL backends downgraded the verification mode before the handshake because no hostname could be bound for in-handshake checks: - SSLClient skipped certificate chain validation entirely; only the post-handshake identity check (IP SAN match) remained, so any untrusted certificate carrying a matching IP SAN was accepted - The WebSocket client skipped verification altogether on Mbed TLS, accepting any certificate Keep the verification mode enabled for IP hosts and verify the certificate identity post-handshake via tls::verify_hostname(), which supports IP SANs on all backends. The WebSocket path now performs the same post-handshake identity check as SSLClient. On Mbed TLS, sessions explicitly opt out of in-handshake hostname verification (mandatory since Mbed TLS 3.6.4) and the post-handshake check covers identity instead; DNS hosts still bind the hostname during the handshake. Also stop sending SNI for IP hosts on Mbed TLS and wolfSSL (RFC 6066).
