News for hackers. Stuff that matters.
Re:Bug in Lynx's SSL certificate validation – leaks password... by kevin_thibedeau on Saturday August 07, 2021 @03:22PM (#28101127)
RFC 6066:

Currently, the only server names supported are DNS hostnames; however, this does not imply any dependency of TLS on DNS, and other name types may be added in the future (by an RFC that updates this document).

Re:Bug in Lynx's SSL certificate validation – leaks password... by tialaramex on Saturday August 07, 2021 @03:46PM (#28101265)
In practice this functionality is rusted in place. If you invented a new name type, that doesn't mean you can call your existing TLS stack's SNI methods with "@Twitter_handle" or "[email protected]" or "#TopicGoesHere" because those methods always write DNS names. There is a type parameter, there has only ever been one type (DNS names) and so that's what your implementation chooses and I haven't ever seen one that lets you change it, because what would you change it to?
Re:Bug in Lynx's SSL certificate validation – leaks password... by kevin_thibedeau on Saturday August 07, 2021 @04:27PM (#28101535)
You don't have to invent a new name type.

RFC 5280:

The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI). Other options exist, including completely local definitions.

Re:Bug in Lynx's SSL certificate validation – leaks password... by agwa on Saturday August 07, 2021 @05:21PM (#28101951)
X509's subject alternative name extension has nothing to do with TLS' SNI extension. SNI does not have a mechanism for locally-defined name types akin to X509's OtherName.
Re:Bug in Lynx's SSL certificate validation – leaks password... by X-Istence on Sunday August 08, 2021 @05:17PM (#28110190)
SNI matches certificates by looking at the SAN list on a list of certificates and finding the best match.