<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<div class=""><br class=""></div><div class="">I had a similar problem with plain TLS socket after 19.x to 20.x migration. This is due to SNI feature. I’ve disabled it using following ssl socket option: {server_name_indication, disable}</div><div class=""><br class=""></div><div class="">I think same applies for dist sockets as well. </div><div class=""><br class=""></div><div class="">Best Regards, </div><div class="">Dmitry<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 22 Jan 2018, at 17.28, San Gillis <<a href="mailto:san.gillis@truqu.com" class="">san.gillis@truqu.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class=""><div class="">Since upgrading to Erlang 20.2 (from 19.3) we've been having issues with using SSL for Erlang distribution.</div></div><div class=""><br class=""></div><div class="">We used to run our nodes with</div><div class="">```</div><div class="">-ssl_dist_opt server_verify verify_peer</div><div class="">-ssl_dist_opt client_verify verify_peer</div><div class="">```</div><div class="">in the vm.args file. Since the upgrade this failed with {bad_cert, hostname_check_failed}.</div><div class=""><br class=""></div><div class="">I noticed that this hostname check fails because `fun public_key:verify_hostname_match_default/2` is receiving `{dns_id, "<a href="mailto:nodename@subdomain.hostname.com" class="">nodename@subdomain.hostname.com</a>"}` and `{dNSName,"*.<a href="http://hostname.com/" class="">hostname.com</a>"}` as arguments, which will fail to check.</div><div class=""><br class=""></div><div class="">I have looked into providing `verify_fun` to do custom verification, but this seems pretty convoluted if I just want to `erl -remsh <a href="mailto:nodename@subdomain.hostname.com" class="">nodename@subdomain.hostname.com</a> -ssl_dist_optfile ...` into the given node.</div><div class=""><br class=""></div><div class="">Did anyone else run into this issue? Are there some better ways to fix this?<br class=""></div></div>
_______________________________________________<br class="">erlang-questions mailing list<br class=""><a href="mailto:erlang-questions@erlang.org" class="">erlang-questions@erlang.org</a><br class="">http://erlang.org/mailman/listinfo/erlang-questions<br class=""></div></blockquote></div><br class=""></div></body></html>