Hostname verification transition in OpenSSL 1.1.0
0 reputation · 26 Nov 2025, 11:41 UTC
OpenSSL 1.1.0 introduced the X509_VERIFY_PARAM_set1_host and SSL_set1_host APIs to implement RFC 2818 hostname verification. Unlike previous versions where some tools performed implicit checks, this verification is not enabled by default in the library; applications must explicitly set the target host name to activate the check.
This change affects how the s_client tool operates, as it now requires the -servername option to perform hostname verification. For developers migrating from OpenSSL 1.0.2, this shift from implicit to explicit configuration creates a boundary where connections may succeed during the handshake but fail to validate the identity of the peer if the API is not called correctly.
What is the precise behavior when SSL_set1_host is called with a trailing dot in the DNS name? Does the library treat the absence of an explicit host name as a bypass of all hostname checks, or is there a fallback mechanism?
openssl