If a cert's CN is not the same as the dNSName SubjectAltName then the DNS response choses the CN. This will not propagate through intermediate DNS servers such as BIND.
Example:
CN = Portland Direct Test
SubjectAltName = dns:portland.hsgincubator.com
Currently the RR.Name (Resource Record top level: rfc 1035, 3.2.1) is set to "Portland Direct Test". This can be directly resolved with a .NET RI but if it uses an intermediate DNS server such as BIND the record will not be propagated by BIND to the client. It has been the convention for all test certs to set CN equal to a valid domain name and this issue was not discovered.
To fix this bug we will need to prioritize the dns typed SubjectAltName. Which is already formated as a domain name (Appropriate Owner Names for CERT RRs, rfc 4398, 3).
If a cert's CN is not the same as the dNSName SubjectAltName then the DNS response choses the CN. This will not propagate through intermediate DNS servers such as BIND.
Example:
CN = Portland Direct Test
SubjectAltName = dns:portland.hsgincubator.com
Currently the RR.Name (Resource Record top level: rfc 1035, 3.2.1) is set to "Portland Direct Test". This can be directly resolved with a .NET RI but if it uses an intermediate DNS server such as BIND the record will not be propagated by BIND to the client. It has been the convention for all test certs to set CN equal to a valid domain name and this issue was not discovered.
To fix this bug we will need to prioritize the dns typed SubjectAltName. Which is already formated as a domain name (Appropriate Owner Names for CERT RRs, rfc 4398, 3).