Rich Megginson wrote: > I'm not sure how NSS handles certificate verification with > subjectAltName. I know that in order for the validation to work without > subjectAltName, the leftmost RDN in the subjectDN must be cn=FQDN of the > server e.g. cn=ldap1.example.com, ou=Fedora Directory Server, > dc=example, dc=com Yes, for server certs which are validated by the client. > I'm also not sure if that applies to cert based auth. It doesn't. Ciao, Michael.
