X509 subject alternative name (subjectAltName) IP address field

问题

X509v3 can contain IP address field in subject Alternative Name extension.

1. As an application verifying the server's identity, how should the IP address field be validated?
2. If both DNS name and IP address are present? Is there a preference of one over the another?
3. What is the use of dirName field?

回答1:

I read RFC 2818 earlier but must have missed this part.

In some cases, the URI is specified as an IP address rather than a
hostname. In this case, the iPAddress subjectAltName must be present
in the certificate and must exactly match the IP in the URI.

回答2:

My answer is based on my experience with TLS/SSL.

1. It's based upon the implementation of the certificate validation. To enforce IP address match, you have to implement that.
2. Whatever way you want. You could also check both.
3. Sorry no idea what this field does.

Have you checked the OpenSSL documentation?

来源：https://stackoverflow.com/questions/9185489/x509-subject-alternative-name-subjectaltname-ip-address-field