Disable commonName matching for certificates

chrome/browser/chromeos/login/test/https_forwarder.py

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """An https server that forwards requests to another server. This allows a
 server that supports http only to be accessed over https.
 """
 
 import BaseHTTPServer
 import minica
 import re
+import socket
 import SocketServer
 import sys
 import urllib2
 import urlparse
 import testserver_base
 import tlslite.api
 
 
 class RedirectSuppressor(urllib2.HTTPErrorProcessor):
   """Prevents urllib2 from following http redirects.
@@ skipping 132 matching lines @@
       server_data: Dictionary that holds information about the server.
     Returns:
       The started server.
     """
     # The server binds to |host:port| but the certificate is issued to
     # |ssl_host| instead.
     port = self.options.port
     host = self.options.host
     ssl_host = self.options.ssl_host
 
+    # Allow |ssl_host| to be an IP address or a domain name, and ensure
+    # it gets added as the appropriate subjectAltName of the generated
+    # certificate.
+    dns_sans = None
+    ip_sans = None
+    ip = None
+    if ip is None:
+      try:
+        ip = socket.inet_pton(socket.AF_INET, ssl_host)
+        ip_sans = [ip]
+      except socket.error:
+        pass
+    if ip is None:
+      try:
+        ip = socket.inet_pton(socket.AF_INET6, ssl_host)
+        ip_sans = [ip]
+      except socket.error:
+        pass
+    if ip is None:
+      dns_sans = [ssl_host]
+
     (pem_cert_and_key, ocsp_der) = minica.GenerateCertKeyAndOCSP(
         subject = self.options.ssl_host,
-        ocsp_url = None)
+        ocsp_url = None,
+        ip_sans = ip_sans,
+        dns_sans = dns_sans)
 
     server = MultiThreadedHTTPSServer((host, port),
                                       RequestForwarder,
                                       pem_cert_and_key)
     print 'HTTPS server started on %s:%d...' % (host, server.server_port)
 
     forward_target = urlparse.urlparse(self.options.forward_target)
     server.forward_scheme = forward_target[0]
     server.forward_netloc = forward_target[1]
     server.forward_path = forward_target[2].rstrip('/')
@@ skipping 16 matching lines @@
     self.option_parser.add_option('--ocsp-produced', help='Ignored (provided '
                                   'for compatibility only).')
     self.option_parser.add_option('--ssl-host', help='The host name that the '
                                   'certificate should be issued to.')
     self.option_parser.add_option('--forward-target', help='The URL prefix to '
                                   'which requests will be forwarded.')
 
 
 if __name__ == '__main__':
   sys.exit(ServerRunner().main())