MDEV-18131 MariaDB does not verify IP addresses from subject alternative

names

Added a call to X509_check_ip_asc() in case server_hostname represents
an IP address.

mysql-test/lib/generate-ssl-certs.sh

@@ -31,7 +31,7 @@ openssl ca -keyfile cakey.pem -days 7300 -batch -cert cacert.pem -policy policy_
 
 # with SubjectAltName, only for OpenSSL 1.0.2+
 cat > demoCA/sanext.conf <<EOF
-subjectAltName=DNS:localhost
+subjectAltName=IP:127.0.0.1, DNS:localhost
 EOF
 openssl req -newkey rsa:1024 -keyout serversan-key.pem -out demoCA/serversan-req.pem -days 7300 -nodes -subj '/CN=server/C=FI/ST=Helsinki/L=Helsinki/O=MariaDB'
 openssl ca -keyfile cakey.pem -extfile demoCA/sanext.conf -days 7300 -batch -cert cacert.pem -policy policy_anything -out serversan-cert.pem -infiles demoCA/serversan-req.pem

mysql-test/r/ssl.result

@@ -3,10 +3,10 @@ have_ssl
 1
 SHOW STATUS LIKE 'Ssl_server_not_before';
 Variable_name	Value
-Ssl_server_not_before	Apr 25 20:52:21 2017 GMT
+Ssl_server_not_before	Apr 24 14:29:39 2019 GMT
 SHOW STATUS LIKE 'Ssl_server_not_after';
 Variable_name	Value
-Ssl_server_not_after	Apr 20 20:52:21 2037 GMT
+Ssl_server_not_after	Apr 19 14:29:39 2039 GMT
 drop table if exists t1,t2,t3,t4;
 CREATE TABLE t1 (
 Period smallint(4) unsigned zerofill DEFAULT '0000' NOT NULL,

mysql-test/r/ssl_verify_ip.result

+1
+1
+1
+1

mysql-test/std_data/cacert.pem

@@ -2,78 +2,78 @@ Certificate:
     Data:
         Version: 3 (0x2)
         Serial Number:
-            e5:b1:e3:71:e9:6f:a9:e1
+            c8:ae:a5:b8:5b:90:50:49
     Signature Algorithm: sha256WithRSAEncryption
-        Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
+        Issuer: CN = cacert, C = FI, ST = Helsinki, L = Helsinki, O = MariaDB
         Validity
-            Not Before: Apr 25 20:52:21 2017 GMT
-            Not After : Apr 20 20:52:21 2037 GMT
-        Subject: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
+            Not Before: Apr 24 14:29:39 2019 GMT
+            Not After : Apr 19 14:29:39 2039 GMT
+        Subject: CN = cacert, C = FI, ST = Helsinki, L = Helsinki, O = MariaDB
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (2048 bit)
                 Modulus:
-                    00:a0:ad:d5:b1:ec:45:6f:d6:33:fc:5a:03:29:14:
-                    f1:8e:78:d5:27:53:79:e0:92:7c:10:3b:79:a0:d7:
-                    b6:9d:a8:5c:4d:fa:68:11:b3:03:9e:ee:5e:20:79:
-                    23:d8:9c:49:34:9c:1d:c4:6e:53:1f:9a:92:1f:08:
-                    c1:15:e2:ad:cf:59:cd:1e:55:84:79:f9:09:ca:36:
-                    8a:50:83:c6:38:48:c6:d3:fa:f6:f2:2a:4f:bd:5d:
-                    60:9d:eb:21:c4:8c:f2:dd:2d:49:10:63:46:47:de:
-                    2d:59:a0:4a:e0:58:e6:c0:ae:d8:d4:5e:9a:f8:f5:
-                    68:1d:ea:80:8a:d6:01:b0:d5:5f:30:4d:88:5a:c5:
-                    1f:81:92:c1:40:54:c8:bb:a6:a1:43:de:81:3c:4b:
-                    79:95:82:bb:52:da:a3:a4:a0:69:ff:7e:00:8c:86:
-                    85:ec:af:03:68:a8:83:48:a0:e4:1d:31:a9:5c:47:
-                    99:9d:3a:3f:b5:3e:12:7c:4d:47:15:72:f1:11:5c:
-                    4a:ef:08:1c:7b:8f:e6:03:06:07:4f:94:21:b0:5e:
-                    27:fa:93:8c:b4:cc:56:34:3b:6d:c4:4a:14:57:b2:
-                    21:1a:3e:2f:c5:9e:47:1a:59:05:22:0e:56:b1:a7:
-                    e8:80:9b:82:c3:54:57:12:05:94:79:a2:03:d9:64:
-                    3c:63
+                    00:d6:d4:5c:62:a3:d7:9a:8e:f3:60:a5:f2:07:64:
+                    bd:f8:2e:16:73:44:1e:4c:5a:96:07:08:88:84:d0:
+                    4d:15:83:0c:af:65:4c:55:42:96:14:82:f8:00:66:
+                    5b:2c:b5:7b:e7:44:a5:aa:4e:63:e1:d9:88:05:2a:
+                    80:c2:f2:4d:70:eb:63:24:7f:f9:d9:70:13:53:cb:
+                    45:12:0c:3c:1e:d2:ce:08:f9:b9:e0:bf:8d:6b:0c:
+                    b9:29:99:31:96:f9:b6:b0:fd:e5:14:d9:e7:3b:77:
+                    26:5c:c1:e3:54:c7:63:e0:a3:30:de:86:06:19:0f:
+                    7e:04:d2:d2:d3:f0:78:23:21:79:3c:9a:42:41:6e:
+                    53:36:de:dc:0f:c7:98:8a:85:79:0a:d4:ef:90:02:
+                    1b:12:3a:60:32:6c:54:c5:8a:7f:74:24:0e:d3:08:
+                    5b:d2:e6:ae:de:17:47:8f:4d:ae:13:00:67:45:e6:
+                    bc:0e:ee:1b:0d:44:b2:0c:25:6d:b8:38:5c:87:c1:
+                    d3:98:27:a1:56:21:5c:42:15:b3:f4:b7:ec:ae:bd:
+                    ae:af:e4:50:0d:34:7c:3c:e1:b1:64:f6:e4:07:53:
+                    9d:96:44:8a:41:e0:3c:df:f2:fc:6d:de:f7:5d:8c:
+                    04:ca:e1:4f:cc:a5:c5:0c:ce:a8:f7:49:b5:63:6b:
+                    02:53
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Key Identifier: 
-                1C:C7:2B:AA:1B:B1:BB:2E:9A:F4:0F:B1:86:60:57:38:C2:41:05:12
+                F3:1D:A0:5F:69:33:8A:A4:B4:76:97:A2:6E:AB:FD:A0:BF:F3:2C:CE
             X509v3 Authority Key Identifier: 
-                keyid:1C:C7:2B:AA:1B:B1:BB:2E:9A:F4:0F:B1:86:60:57:38:C2:41:05:12
+                keyid:F3:1D:A0:5F:69:33:8A:A4:B4:76:97:A2:6E:AB:FD:A0:BF:F3:2C:CE
 
-            X509v3 Basic Constraints: 
+            X509v3 Basic Constraints: critical
                 CA:TRUE
     Signature Algorithm: sha256WithRSAEncryption
-         0d:4b:21:52:fa:49:34:56:14:db:83:ae:1c:3d:a7:4d:3e:ea:
-         55:7e:1a:37:7a:65:89:ee:19:05:94:9d:3a:ad:59:c4:38:16:
-         b2:bd:02:ee:5a:a6:7e:e2:b1:21:a3:ad:af:8c:ae:c3:30:71:
-         ad:d7:d2:24:0f:c4:d9:47:80:c5:95:05:1d:7c:8a:49:0a:7d:
-         8b:61:ca:b5:68:3d:3e:4e:f1:c7:45:62:c8:cc:a9:2f:f3:12:
-         f1:3f:92:34:7f:07:ab:d3:ac:ab:af:2d:c9:69:63:8a:b2:e5:
-         35:ea:7d:b8:17:38:72:82:5f:96:3d:dc:8d:e5:11:bb:ae:f3:
-         02:2d:20:77:5c:64:59:18:a6:e7:fa:c7:89:e8:30:12:14:04:
-         40:5b:e9:b1:8f:86:81:b9:0d:6c:b6:fc:98:f9:b7:52:ab:8f:
-         7e:53:c8:a0:05:e4:cd:0d:6b:d2:74:9f:17:7a:a1:c3:76:5e:
-         f3:29:1c:c6:be:56:ab:02:f7:5d:e1:c9:21:27:6d:66:7a:41:
-         29:49:a3:f8:f5:2a:e7:03:2a:7c:52:4b:f5:46:58:45:be:a4:
-         4c:a0:65:37:1d:d8:ac:f8:1f:81:ca:9c:79:f0:ff:22:8c:1d:
-         ce:2b:d0:1e:ce:99:f2:db:fa:66:84:e6:86:6f:19:3b:10:f1:
-         92:ac:57:b2
+         0c:1b:af:48:e0:29:ff:d5:23:27:4f:0b:f6:4d:d3:c6:73:13:
+         ee:fa:ba:84:9e:22:c6:c4:35:11:d3:aa:42:11:a5:4f:97:39:
+         72:d5:eb:6e:3e:d1:75:dc:51:bc:bc:ab:2a:0d:28:aa:3a:2e:
+         f1:7f:ae:a0:16:27:07:2e:a3:f1:06:ed:33:9b:8f:b5:3a:ca:
+         8c:a7:e8:fe:b9:a4:b3:4e:c1:27:7d:7b:23:33:10:fe:27:4b:
+         a2:b1:6a:32:09:30:84:24:d2:1d:02:9d:41:3b:ba:4e:51:ff:
+         ce:98:c3:c9:9a:22:b8:ac:21:5b:c3:89:28:8e:3b:6a:9c:d3:
+         5f:ef:99:6d:ac:f5:56:81:09:97:22:31:96:49:b8:75:1d:71:
+         5c:76:7d:64:87:77:18:30:4e:43:f7:c3:1a:f9:d5:cf:97:29:
+         28:cf:40:84:da:35:29:bc:f6:9a:9e:e9:ce:f8:cc:57:02:41:
+         13:d1:60:18:41:60:b7:17:c6:b6:6d:71:d8:20:50:56:13:3c:
+         6c:23:0e:91:1b:2f:8d:31:e8:82:da:71:5f:6c:1c:3f:f6:7f:
+         2c:30:47:eb:89:c6:28:9b:61:62:43:e2:3a:91:48:0b:1e:2a:
+         c0:d9:a0:59:69:4f:13:58:cc:4a:8a:37:2e:c6:c1:a1:7b:03:
+         4a:e5:cb:98
 -----BEGIN CERTIFICATE-----
-MIIDfzCCAmegAwIBAgIJAOWx43Hpb6nhMA0GCSqGSIb3DQEBCwUAMFYxDzANBgNV
+MIIDgjCCAmqgAwIBAgIJAMiupbhbkFBJMA0GCSqGSIb3DQEBCwUAMFYxDzANBgNV
 BAMMBmNhY2VydDELMAkGA1UEBhMCRkkxETAPBgNVBAgMCEhlbHNpbmtpMREwDwYD
-VQQHDAhIZWxzaW5raTEQMA4GA1UECgwHTWFyaWFEQjAeFw0xNzA0MjUyMDUyMjFa
-Fw0zNzA0MjAyMDUyMjFaMFYxDzANBgNVBAMMBmNhY2VydDELMAkGA1UEBhMCRkkx
+VQQHDAhIZWxzaW5raTEQMA4GA1UECgwHTWFyaWFEQjAeFw0xOTA0MjQxNDI5Mzla
+Fw0zOTA0MTkxNDI5MzlaMFYxDzANBgNVBAMMBmNhY2VydDELMAkGA1UEBhMCRkkx
 ETAPBgNVBAgMCEhlbHNpbmtpMREwDwYDVQQHDAhIZWxzaW5raTEQMA4GA1UECgwH
-TWFyaWFEQjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKCt1bHsRW/W
-M/xaAykU8Y541SdTeeCSfBA7eaDXtp2oXE36aBGzA57uXiB5I9icSTScHcRuUx+a
-kh8IwRXirc9ZzR5VhHn5Cco2ilCDxjhIxtP69vIqT71dYJ3rIcSM8t0tSRBjRkfe
-LVmgSuBY5sCu2NRemvj1aB3qgIrWAbDVXzBNiFrFH4GSwUBUyLumoUPegTxLeZWC
-u1Lao6Sgaf9+AIyGheyvA2iog0ig5B0xqVxHmZ06P7U+EnxNRxVy8RFcSu8IHHuP
-5gMGB0+UIbBeJ/qTjLTMVjQ7bcRKFFeyIRo+L8WeRxpZBSIOVrGn6ICbgsNUVxIF
-lHmiA9lkPGMCAwEAAaNQME4wHQYDVR0OBBYEFBzHK6obsbsumvQPsYZgVzjCQQUS
-MB8GA1UdIwQYMBaAFBzHK6obsbsumvQPsYZgVzjCQQUSMAwGA1UdEwQFMAMBAf8w
-DQYJKoZIhvcNAQELBQADggEBAA1LIVL6STRWFNuDrhw9p00+6lV+Gjd6ZYnuGQWU
-nTqtWcQ4FrK9Au5apn7isSGjra+MrsMwca3X0iQPxNlHgMWVBR18ikkKfYthyrVo
-PT5O8cdFYsjMqS/zEvE/kjR/B6vTrKuvLclpY4qy5TXqfbgXOHKCX5Y93I3lEbuu
-8wItIHdcZFkYpuf6x4noMBIUBEBb6bGPhoG5DWy2/Jj5t1Krj35TyKAF5M0Na9J0
-nxd6ocN2XvMpHMa+VqsC913hySEnbWZ6QSlJo/j1KucDKnxSS/VGWEW+pEygZTcd
-2Kz4H4HKnHnw/yKMHc4r0B7OmfLb+maE5oZvGTsQ8ZKsV7I=
+TWFyaWFEQjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANbUXGKj15qO
+82Cl8gdkvfguFnNEHkxalgcIiITQTRWDDK9lTFVClhSC+ABmWyy1e+dEpapOY+HZ
+iAUqgMLyTXDrYyR/+dlwE1PLRRIMPB7Szgj5ueC/jWsMuSmZMZb5trD95RTZ5zt3
+JlzB41THY+CjMN6GBhkPfgTS0tPweCMheTyaQkFuUzbe3A/HmIqFeQrU75ACGxI6
+YDJsVMWKf3QkDtMIW9Lmrt4XR49NrhMAZ0XmvA7uGw1Esgwlbbg4XIfB05gnoVYh
+XEIVs/S37K69rq/kUA00fDzhsWT25AdTnZZEikHgPN/y/G3e912MBMrhT8ylxQzO
+qPdJtWNrAlMCAwEAAaNTMFEwHQYDVR0OBBYEFPMdoF9pM4qktHaXom6r/aC/8yzO
+MB8GA1UdIwQYMBaAFPMdoF9pM4qktHaXom6r/aC/8yzOMA8GA1UdEwEB/wQFMAMB
+Af8wDQYJKoZIhvcNAQELBQADggEBAAwbr0jgKf/VIydPC/ZN08ZzE+76uoSeIsbE
+NRHTqkIRpU+XOXLV624+0XXcUby8qyoNKKo6LvF/rqAWJwcuo/EG7TObj7U6yoyn
+6P65pLNOwSd9eyMzEP4nS6KxajIJMIQk0h0CnUE7uk5R/86Yw8maIrisIVvDiSiO
+O2qc01/vmW2s9VaBCZciMZZJuHUdcVx2fWSHdxgwTkP3wxr51c+XKSjPQITaNSm8
+9pqe6c74zFcCQRPRYBhBYLcXxrZtcdggUFYTPGwjDpEbL40x6ILacV9sHD/2fyww
+R+uJxiibYWJD4jqRSAseKsDZoFlpTxNYzEqKNy7GwaF7A0rly5g=
 -----END CERTIFICATE-----

mysql-test/std_data/cakey.pem

 -----BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCgrdWx7EVv1jP8
-WgMpFPGOeNUnU3ngknwQO3mg17adqFxN+mgRswOe7l4geSPYnEk0nB3EblMfmpIf
-CMEV4q3PWc0eVYR5+QnKNopQg8Y4SMbT+vbyKk+9XWCd6yHEjPLdLUkQY0ZH3i1Z
-oErgWObArtjUXpr49Wgd6oCK1gGw1V8wTYhaxR+BksFAVMi7pqFD3oE8S3mVgrtS
-2qOkoGn/fgCMhoXsrwNoqINIoOQdMalcR5mdOj+1PhJ8TUcVcvERXErvCBx7j+YD
-BgdPlCGwXif6k4y0zFY0O23EShRXsiEaPi/FnkcaWQUiDlaxp+iAm4LDVFcSBZR5
-ogPZZDxjAgMBAAECggEAWmy6AGFpSmEP7IpzkOEaeAWEX5dY1YtaioAOGPiM6vje
-yXuMqblG5mBbVIcYJ0T85cCd9/fmi7ifVxvEHh7tle2Bw/p4jXQbkFNVT655FR/P
-1Wg9JVeufHFaeETlQgnYe6SKo9BaswNUHkZZHRyq7/D2Ub3UFRt2tq9MG9YIKY1m
-rP9s7E+EDuH9UhYmaWdQfNm8muIXWK8WjicI5+PX0CQ1NtUy6vS7qBzcBzvT0chC
-Jtja29S6Nvg12A96nHsRmQyUaQjRlqosSwiagpc5mZmNeCEUoY+3deIdYIUMSQnf
-judZOKVPq0GOW5Y1U068LGODWaifPkinGBj+04VH0QKBgQDOp/jVCOUdEeqFJ/8m
-wEsfsRIrXvtGJHgbDXcVJ69FwlX+yaKGEuC+4f21uyxPn6GoFw+NKAyTmGKH7VAX
-OFQLrMQ/DMlNbZrCAAFcXMqrnLaVwqMeIIoVNfKAa8u15K40qc+B0it61Nlay5wq
-wvXoSZrdqXSgsI29pav20+8pTQKBgQDHC3l1+gMZ1rCar+5KdVBN1Wq4Xh7cwZw6
-FxEvyrDCJePEU2L7FpH1pFuB4WpXdBu3CPo70ZgwfqBXn4qLOOI3gTtDHActyiUm
-+WRG62O+5Ye7aLB4xy0MfnKNA2g/yHj1ozwM8kA5JRptAzDnzWfVE0k47/pVAVzt
-E2bZuSykbwKBgQCL6SkMgjMr1T9j20phn/q8gBN/DZUtTe+K0Tj4N5/wqLuz/its
-fkdutG4ipZBAcCDwPnym4qBxJNBAmqiIr/gm11ceILgBFd2azoodUC1etoDfL6Fj
-+j/CUH3X+CM5CJPwz67Pg80wIf7t+7/FK611ELAqtllhmWa9KPcd6yqWWQKBgHh5
-Xnvk5kmWY3BNOgrBNOjXWu/asA1n9lpGqfVmVlQ8wL6MxiU5xQCMCYL0X/ws37WK
-boMUWmxHyF8gxqd7t5hm1OrKpSG274PGgUZXpRjfLqdlNyLzUzXztvvY6xloCqaK
-tYcUfYDZD0SaINi8v7L9KF2ZCsi2uXsZOjBf30BrAoGAXPPotkw/CkcPQBS13cha
-ZWeeH5NDKBADWXfLfcRUs108c9xw4BYr5yGilSPscN2ZP0/iWONKp/c6/STS54t5
-lkOKKUbkAFbQu8UKa1J7zrnHZv+Mr4I/iBBy6VkN8Spp2vBI3Ng6jhPIJg3Gum9p
-943wWtAnIhe/UqCRT3a/GZg=
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDW1Fxio9eajvNg
+pfIHZL34LhZzRB5MWpYHCIiE0E0VgwyvZUxVQpYUgvgAZlsstXvnRKWqTmPh2YgF
+KoDC8k1w62Mkf/nZcBNTy0USDDwe0s4I+bngv41rDLkpmTGW+baw/eUU2ec7dyZc
+weNUx2PgozDehgYZD34E0tLT8HgjIXk8mkJBblM23twPx5iKhXkK1O+QAhsSOmAy
+bFTFin90JA7TCFvS5q7eF0ePTa4TAGdF5rwO7hsNRLIMJW24OFyHwdOYJ6FWIVxC
+FbP0t+yuva6v5FANNHw84bFk9uQHU52WRIpB4Dzf8vxt3vddjATK4U/MpcUMzqj3
+SbVjawJTAgMBAAECggEAZFozBcjvcD2SpvUdyCJhM0ukJRgO5y/xoTt1OkVrnL7o
+8A3ryHAgV1iOrPEjahEk3fWNRa70rY3GIlOmbmptjnAGkghOGCpofN4ZV8LrWqKy
+qDKvh7MzRmxdGnd7WMExfCA+IK1hfL+95dqUbQfvOgJBU9Fbi91Wyr4IygQsuouP
+Nog3FLz4jejr578qx310Nm0ppNWDa9vWWoiu4bW9u7mqYXhrOiLBxPp/EP2sg5+S
+yocjtHSfcrMDBOdiluFWlNyX69uKXWDyge/F9H5whuW5H4JRHv3i3sUcaXK/PF8D
+RwJCDiX4E7M7JVG1EgCz4kC0GyTNGihwSTB66DJxcQKBgQDyM+M71wiMQxseCCZa
+sBbRfNm100agUNRUBWGrmOLXj6eThkwNknndAZh4nUpuGOYO0CZrnfO4rUBAjpTx
+7++0OGJEf7CEX26da5Ge+ywkgxpOaVbhliuDeFZ3Lqy/1UcUVPvxPy27Sc6i6SYt
+gKaej3KpyJW0nUi2Fmca1mHp7QKBgQDjEUhYrMJrXLbmR6AELp7sbTTw1fFp2jUC
+iiM3lEYfuiUprOCXe6m2yWkd0mF2YyGZt7Z2LMX4jIRe06h4c7WSMuHAbb9Tvro9
+Kp7Xgq6+edKSdIQG8mb/UXauEuhqRyt2Y8Xr18yPlmpViI+xiAWT9x/9otpkxMVu
+RiUVEWoVPwKBgQDb2AtXgr0Ii9TucplV0eY0aq4247qExDmmtmfMWW72GTgTqWAZ
+Ja6l08/xE1y/CKyyH2/wWSQjqmba8lDyNkcO/+r6oCi6TuFZ1I0OkJCl57aWG/m3
+tBZ1NGLPtbcqPU5Sfz1c4msBSGJe72AvB0q2PCDpSd/RXL7mQPl/m76ulQKBgALx
+7HBJ/VOLJkwiTa8AM8t5NyCQhcsLq3hW9lH4OFic/3Jk7ZzJW9AlGJnsapswefUW
+buVle0PX/reEI0E8rvQweMEYK00Ywi2c6eZ9qWqLBfIkVLoKVs+k7NchI6aNOcEV
+VjHS4LJUDxkA5mw1CW173QxbGl4IN09Q1ZZKXYfdAoGATv50WfkAxn+wA3R8edUk
+ZIqqxoeh3isSN7XSQCypFIKGP0Cmo4cjcvgyXVGYX3b9a2LiNRags/q4S2ZGLz9C
+Ksv9uiyKA8THhcdx4RVUQuWEjyGzivwkk9UHTZhwOM+ED0HyE5/gnMs2RJVMMd7W
+0tocCTiUvCxfBB3W77Nm48g=
 -----END PRIVATE KEY-----

mysql-test/std_data/client-cert.pem

@@ -5,22 +5,22 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
         Validity
-            Not Before: Apr 25 20:52:33 2017 GMT
-            Not After : Apr 20 20:52:33 2037 GMT
+            Not Before: Apr 24 14:29:50 2019 GMT
+            Not After : Apr 19 14:29:50 2039 GMT
         Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN=client
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (1024 bit)
                 Modulus:
-                    00:a1:10:ea:cc:8e:2c:73:6b:33:1a:5e:26:19:b6:
-                    4b:4c:bc:04:b8:c2:e2:33:eb:67:a2:7a:27:af:3f:
-                    f7:ef:49:5f:c1:d2:b9:d9:71:fe:17:a0:93:da:dc:
-                    f1:47:de:fa:1f:c3:c1:d1:a5:2a:06:cb:b3:e8:9a:
-                    c1:bd:78:77:68:45:c1:55:cd:b1:c1:d3:df:8c:12:
-                    4f:c2:3a:0d:b7:58:dc:ca:13:08:b9:fb:12:24:90:
-                    aa:b7:4e:04:eb:43:0d:45:be:1c:17:d6:a8:b1:af:
-                    10:3c:39:d6:08:45:ed:a9:7e:3a:69:ae:70:22:86:
-                    7e:71:1f:f1:0e:d0:0d:32:c3
+                    00:ab:9b:08:e8:ee:c3:21:9e:b5:dc:3e:03:b2:4e:
+                    d5:45:58:7f:dd:95:a1:d9:b1:86:c5:1b:c5:d6:66:
+                    52:73:2c:d4:eb:53:80:0c:02:1d:8b:40:43:b1:e9:
+                    db:a1:87:d7:61:f2:35:b0:4f:bf:1b:20:87:60:6f:
+                    4f:0a:df:8e:1b:32:fb:69:d3:be:24:20:77:be:cf:
+                    f6:4f:23:fc:2c:f4:12:a1:b9:54:7e:74:e2:21:7f:
+                    03:e5:03:a3:17:a6:eb:c5:1b:38:3f:35:9d:b9:67:
+                    73:d3:80:c5:61:f4:8d:48:2e:cf:f0:aa:59:36:7c:
+                    4f:f6:37:f4:b7:7d:fe:1d:87
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: 
@@ -28,42 +28,42 @@ Certificate:
             Netscape Comment: 
                 OpenSSL Generated Certificate
             X509v3 Subject Key Identifier: 
-                0C:20:76:A1:80:9C:2F:30:3D:F7:AB:8D:31:19:AD:E2:F7:E2:8D:12
+                53:3C:D1:92:1E:19:3C:32:DA:BF:5E:2E:11:E8:17:A8:1C:77:27:DE
             X509v3 Authority Key Identifier: 
-                keyid:1C:C7:2B:AA:1B:B1:BB:2E:9A:F4:0F:B1:86:60:57:38:C2:41:05:12
+                keyid:F3:1D:A0:5F:69:33:8A:A4:B4:76:97:A2:6E:AB:FD:A0:BF:F3:2C:CE
 
     Signature Algorithm: sha256WithRSAEncryption
-         39:c0:90:13:19:85:47:9d:c6:ab:8c:c6:c9:0f:33:11:19:f7:
-         01:2c:1b:08:f6:81:98:11:ab:48:05:d9:b2:29:56:32:9c:ba:
-         e5:40:df:85:5e:6d:fd:6e:36:9a:14:eb:90:50:57:de:2f:ed:
-         2d:89:a6:8a:40:1c:41:84:9b:da:e1:6d:e6:7c:46:b2:e0:90:
-         93:02:1c:52:2e:af:b4:d4:a1:d8:9d:19:cf:0a:67:bf:c3:3e:
-         2e:02:f4:3e:bc:2e:59:57:30:85:8a:32:ab:22:88:72:37:6e:
-         ee:ed:f8:53:72:c9:28:87:50:47:81:1b:80:4c:f8:80:ce:2f:
-         47:ca:78:ce:38:51:70:ec:df:ee:fc:ea:5a:40:1e:4d:1c:fd:
-         4e:f6:74:d0:22:a4:7e:57:df:16:1a:a0:8d:be:fe:ee:f2:07:
-         2e:39:a1:97:40:19:f9:3b:b8:e7:c4:98:6e:1d:1a:27:d3:19:
-         4c:5c:c9:c3:31:98:c1:3c:27:0e:6a:de:cf:88:72:cf:e4:65:
-         c9:0d:33:32:f1:ea:f7:dd:5b:9d:42:6d:ee:c7:a8:b7:85:d2:
-         41:e0:84:38:ce:86:81:ba:6e:7d:d5:ad:7a:00:58:d7:c5:83:
-         9e:5c:1d:38:32:72:49:f5:42:4b:e7:c6:5c:12:6d:e1:5d:51:
-         2c:f5:52:f0
+         8d:f9:38:ab:6e:7b:b5:91:80:f0:51:8f:0c:67:b9:39:64:c1:
+         5e:e6:da:2b:f6:7c:8d:37:13:d4:47:a3:2f:be:04:53:da:b0:
+         dc:d1:35:88:ee:3f:52:be:17:ea:ae:ec:2b:cd:e3:cd:6b:8f:
+         09:e5:c2:aa:9b:50:aa:ea:63:ea:74:97:b5:ab:c9:27:6c:1d:
+         8a:80:a0:49:7b:0f:6e:77:92:6c:db:0c:a8:c0:5d:c3:6a:54:
+         24:52:6d:87:22:49:67:68:89:16:35:bc:eb:94:59:f7:2a:55:
+         dd:50:ca:ee:c8:72:4d:03:92:e3:10:46:d5:20:80:09:cd:db:
+         fd:c8:b2:de:4f:1f:c9:96:8f:d1:cf:81:99:d2:ab:b9:c5:27:
+         e0:40:e8:76:e9:a4:4d:c9:03:0b:be:d5:f1:f4:42:ce:2c:83:
+         6e:3e:80:bd:cb:59:36:4d:34:47:08:91:a8:e1:23:f5:e0:af:
+         89:ae:1a:74:3e:ea:82:19:07:ef:3c:d6:3f:cf:5c:75:5e:57:
+         c7:32:17:b1:16:36:7c:7b:a7:45:aa:de:e1:b8:c1:a2:05:1a:
+         e4:30:51:a3:af:9e:ac:a0:8a:fc:fd:9d:b3:a9:ae:25:62:91:
+         cb:ee:e7:bc:fc:9c:3c:e9:15:ee:a2:6f:f5:f1:fd:6e:59:a9:
+         41:0b:c6:7d
 -----BEGIN CERTIFICATE-----
 MIIDHjCCAgagAwIBAgIBAzANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
 cnQxCzAJBgNVBAYTAkZJMREwDwYDVQQIDAhIZWxzaW5raTERMA8GA1UEBwwISGVs
-c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTcwNDI1MjA1MjMzWhcNMzcwNDIw
-MjA1MjMzWjBWMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
+c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTkwNDI0MTQyOTUwWhcNMzkwNDE5
+MTQyOTUwWjBWMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
 BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMQ8wDQYDVQQDDAZjbGllbnQw
-gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKEQ6syOLHNrMxpeJhm2S0y8BLjC
-4jPrZ6J6J68/9+9JX8HSudlx/hegk9rc8Ufe+h/DwdGlKgbLs+iawb14d2hFwVXN
-scHT34wST8I6DbdY3MoTCLn7EiSQqrdOBOtDDUW+HBfWqLGvEDw51ghF7al+Ommu
-cCKGfnEf8Q7QDTLDAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8W
-HU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQMIHahgJwv
-MD33q40xGa3i9+KNEjAfBgNVHSMEGDAWgBQcxyuqG7G7Lpr0D7GGYFc4wkEFEjAN
-BgkqhkiG9w0BAQsFAAOCAQEAOcCQExmFR53Gq4zGyQ8zERn3ASwbCPaBmBGrSAXZ
-silWMpy65UDfhV5t/W42mhTrkFBX3i/tLYmmikAcQYSb2uFt5nxGsuCQkwIcUi6v
-tNSh2J0Zzwpnv8M+LgL0PrwuWVcwhYoyqyKIcjdu7u34U3LJKIdQR4EbgEz4gM4v
-R8p4zjhRcOzf7vzqWkAeTRz9TvZ00CKkflffFhqgjb7+7vIHLjmhl0AZ+Tu458SY
-bh0aJ9MZTFzJwzGYwTwnDmrez4hyz+RlyQ0zMvHq991bnUJt7seot4XSQeCEOM6G
-gbpufdWtegBY18WDnlwdODJySfVCS+fGXBJt4V1RLPVS8A==
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKubCOjuwyGetdw+A7JO1UVYf92V
+odmxhsUbxdZmUnMs1OtTgAwCHYtAQ7Hp26GH12HyNbBPvxsgh2BvTwrfjhsy+2nT
+viQgd77P9k8j/Cz0EqG5VH504iF/A+UDoxem68UbOD81nblnc9OAxWH0jUguz/Cq
+WTZ8T/Y39Ld9/h2HAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8W
+HU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRTPNGSHhk8
+Mtq/Xi4R6BeoHHcn3jAfBgNVHSMEGDAWgBTzHaBfaTOKpLR2l6Juq/2gv/MszjAN
+BgkqhkiG9w0BAQsFAAOCAQEAjfk4q257tZGA8FGPDGe5OWTBXubaK/Z8jTcT1Eej
+L74EU9qw3NE1iO4/Ur4X6q7sK83jzWuPCeXCqptQqupj6nSXtavJJ2wdioCgSXsP
+bneSbNsMqMBdw2pUJFJthyJJZ2iJFjW865RZ9ypV3VDK7shyTQOS4xBG1SCACc3b
+/ciy3k8fyZaP0c+BmdKrucUn4EDodumkTckDC77V8fRCziyDbj6AvctZNk00RwiR
+qOEj9eCvia4adD7qghkH7zzWP89cdV5XxzIXsRY2fHunRare4bjBogUa5DBRo6+e
+rKCK/P2ds6muJWKRy+7nvPycPOkV7qJv9fH9blmpQQvGfQ==
 -----END CERTIFICATE-----

mysql-test/std_data/client-key.pem

 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQChEOrMjixzazMaXiYZtktMvAS4wuIz62eieievP/fvSV/B0rnZ
-cf4XoJPa3PFH3vofw8HRpSoGy7PomsG9eHdoRcFVzbHB09+MEk/COg23WNzKEwi5
-+xIkkKq3TgTrQw1FvhwX1qixrxA8OdYIRe2pfjpprnAihn5xH/EO0A0ywwIDAQAB
-AoGAaJMqT+vTcpDcmjcct78DPuwoiKmH4rvqCrUTRRbcbJGQSbD/F+6KUl7hAM5J
-Hifo8GzST8LT+ZuS0OiB9/naVGJjcLzpV+us+keMctB/cjmsPAAsRdeA8Xk0jTWv
-v+5a5ZWSSbRXycuUtywtoESY1RLEyB0k3Dcxvk6SD3LnNMkCQQDTyDJfP+eirhgC
-mKiNvHJjLtlRT11IMLMVTELEntsyKqzVgficZCWGkFRoF9iEO1OyCJaug7RZsuxs
-Z3lk/gq1AkEAwrHwzVPU+dTqsZ8tYHlq+d0xy+6eTtYy7e/5qH3AUz10us6BG/LY
-XVTwRFAOKQOciKZ/zPQa4oYeAc0oozSalwJBAIuMbyS0Rz262bdcQDSk5/rS8//P
-+/eFn3t5NMW6p1T3KcvGSLtEgjWZBQVSMSlwrkWxwxhbUIuKip8jz6nse8ECQDgm
-g5FkLRdEfc9uXfLl8aFQVu0+y29nPVb8D9+1LMOVBNZfekLqPdZlCcpZ4EuZ3ApZ
-IqCkgiB0l7DjT2YKZM8CQQCp8z1JvoNRwhIuojh7JajY5QBkXtvHootXr+vDUHNf
-SgR5BRmqZb0F5/BK4/7JbumiHI11QUULxhOnNtlS7DDt
+MIICXQIBAAKBgQCrmwjo7sMhnrXcPgOyTtVFWH/dlaHZsYbFG8XWZlJzLNTrU4AM
+Ah2LQEOx6duhh9dh8jWwT78bIIdgb08K344bMvtp074kIHe+z/ZPI/ws9BKhuVR+
+dOIhfwPlA6MXpuvFGzg/NZ25Z3PTgMVh9I1ILs/wqlk2fE/2N/S3ff4dhwIDAQAB
+AoGAdDsE9OhLKGlcGjmyvUHh+B8yM/5WaqFwe+8Mt+QEMliKOn4K+5cvNZMohsez
+6BufCYtJTAsnkJMevnWF3wJ+N9ceuFmYP0iiliKaC6pfrytSSO7XBcluGawHTJl6
+xwG2BonBgAUGClAQY6yeA3QAkos9Cwl2yBOSsOBFp0BCTxkCQQDjHpEb+TRPNeS9
+9dtrl+00n8XV8E8BZrcPdb7bCllhPrxmLD9T3ZgDiya5ZelzRCpySRQfqVV4sVO1
+UnAn0w29AkEAwW1S15bXHgCFutLlOlAc09PK39JbtLijxEaIwAMdyR8i8v9zkB8M
+/bjARB/6sY6Pwr8ISewnkWVdLWLNSTTCkwJATAbFaGnJOuK9iWEtbBzVSJJbNTxW
+Fg/+I2y00LnsJYNMqZ8SK863vifsdI9K0Ez3MH6J//c9J0Ok08Oey5X4uQJBAKhE
+JnEN841R/wQLOwaDctCDylTzdnu8tBqnEYeYLm0r/QdPWoThvjdqZTfeagPUdROB
+hABqw/EkMO6uqM8qaqkCQQCPQ2Nz10wnsMY2wNs6gnHkqQX+ociiOVWrp6lwWx+K
+NTZg1FIkLEWFfH+meTguOSso/IXt+HlWb6sHth00OeJi
 -----END RSA PRIVATE KEY-----

mysql-test/std_data/server-cert.pem

@@ -5,22 +5,22 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
         Validity
-            Not Before: Apr 25 20:52:21 2017 GMT
-            Not After : Apr 20 20:52:21 2037 GMT
+            Not Before: Apr 24 14:29:39 2019 GMT
+            Not After : Apr 19 14:29:39 2039 GMT
         Subject: C=FI, ST=state or province within country, in other certificates in this file it is the same as L, L=location, usually an address but often ambiguously used, O=organization name, typically a company name, OU=organizational unit name, a division name within an organization, CN=localhost
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (1024 bit)
                 Modulus:
-                    00:c9:fe:83:3f:0b:38:89:1d:43:15:93:5c:26:b9:
-                    80:65:41:bd:2f:63:66:5e:db:fa:33:20:d9:c7:e1:
-                    35:f3:14:3c:c8:b4:f7:09:d8:f5:b5:44:8f:6b:7e:
-                    a0:a4:3b:45:5f:e6:f4:0f:08:67:f8:5a:4c:49:e4:
-                    e5:39:31:69:8c:cf:25:78:93:a6:7f:58:e9:90:9c:
-                    61:cb:2e:14:b1:57:b2:15:9c:ea:8d:6f:96:20:fe:
-                    29:ed:2c:71:b8:4f:1f:e0:05:6c:04:b1:7e:e0:bc:
-                    42:8e:bf:95:5e:a9:5e:c9:c9:a4:64:c2:1f:59:94:
-                    14:c2:06:44:79:bc:d2:65:2d
+                    00:b6:42:a0:5e:1e:05:5e:7f:15:bf:7c:a4:d6:c7:
+                    a8:cd:cc:db:f4:c4:e5:6d:f3:53:47:90:7b:d2:d6:
+                    d9:0d:45:7c:62:aa:81:64:3d:b8:db:29:1f:0c:af:
+                    35:69:d3:82:7a:66:86:7b:97:ce:0f:54:a1:7c:ae:
+                    97:0c:0b:7a:1e:cc:60:bb:c5:bb:a1:47:d3:c8:22:
+                    a0:79:11:2c:09:85:f2:2d:be:24:5a:73:88:d8:45:
+                    bc:6d:d2:9e:7b:8d:9d:55:f2:c1:1e:e6:cd:20:a0:
+                    8b:b4:3b:85:0c:4b:06:b3:d5:1e:51:1f:a5:ea:fc:
+                    81:74:c6:bd:59:f8:81:35:05
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Basic Constraints: 
@@ -28,47 +28,47 @@ Certificate:
             Netscape Comment: 
                 OpenSSL Generated Certificate
             X509v3 Subject Key Identifier: 
-                CB:22:3B:E6:DA:B8:3D:7E:39:61:18:38:50:C8:4D:B4:C8:9A:3E:2B
+                2E:E9:8D:DA:55:FE:77:34:F0:0F:F0:07:02:31:7C:7D:DE:D4:0C:D5
             X509v3 Authority Key Identifier: 
-                keyid:1C:C7:2B:AA:1B:B1:BB:2E:9A:F4:0F:B1:86:60:57:38:C2:41:05:12
+                keyid:F3:1D:A0:5F:69:33:8A:A4:B4:76:97:A2:6E:AB:FD:A0:BF:F3:2C:CE
 
     Signature Algorithm: sha256WithRSAEncryption
-         8e:b7:3d:cc:2b:e5:27:49:49:5a:d4:3c:83:9b:2f:7d:11:de:
-         6b:0f:b4:51:02:e4:37:d0:c4:b5:7b:4b:e3:42:93:75:32:d1:
-         eb:41:a2:27:fe:4d:91:ae:2b:a0:8b:3b:7f:e9:1b:47:85:73:
-         9f:b7:05:74:34:eb:62:12:d8:f2:24:6a:b4:24:58:7a:6a:55:
-         3e:ba:54:f9:51:de:54:0e:19:06:f6:01:23:32:0a:6c:81:e2:
-         57:8a:9e:71:c5:ba:ca:c3:0f:18:d4:ef:54:4b:e1:ee:7c:3a:
-         f3:4d:c3:a3:44:21:9f:c8:ef:85:01:ab:fe:a9:7b:36:05:10:
-         25:5e:61:b8:1d:7c:40:8a:5d:5b:c1:bb:7c:79:45:6e:84:63:
-         b5:3f:51:e9:9c:57:01:de:2d:1e:85:cb:83:f0:16:6d:78:bb:
-         12:01:a5:e5:a2:a7:80:fa:54:8f:9a:5c:de:1c:52:a2:bd:00:
-         49:e4:04:65:30:f9:b9:fc:4f:94:e2:d8:39:89:b6:a5:a5:2d:
-         db:25:a3:0d:5b:f9:e1:2a:13:19:5e:d7:1a:33:89:5b:ac:bd:
-         29:26:da:1a:90:7e:08:19:dd:59:4b:50:fd:46:c3:0b:91:33:
-         8b:c6:70:d1:22:18:37:a3:8b:d3:8f:f8:68:cf:38:8e:e1:ef:
-         ac:17:88:ca
+         8e:80:73:98:21:69:44:9a:75:e9:08:ec:53:fa:48:84:6b:36:
+         66:d6:84:0d:1c:d0:89:c8:9e:59:0b:33:64:2d:92:ee:a3:f1:
+         c9:a4:5f:52:5f:b3:39:d9:36:9a:0d:9b:44:79:72:27:81:06:
+         8b:bb:b7:ec:f2:d4:23:ca:03:0b:19:44:c5:64:9a:0e:e9:b5:
+         4a:db:bb:7a:47:65:5f:be:00:25:0b:67:42:ad:3a:89:ba:e7:
+         97:c1:88:dd:22:49:57:21:3d:fe:c3:e8:ab:70:6c:d1:a3:7d:
+         3e:ac:8f:d5:a7:df:4e:5a:de:7b:71:60:16:a8:5c:c8:3b:9a:
+         f9:86:92:27:ae:9b:73:fb:0f:f0:09:d0:9d:f0:2a:df:54:86:
+         44:b5:29:af:93:d3:03:fa:48:72:44:69:85:d3:9f:d5:7f:5c:
+         4c:30:af:e7:37:0b:db:29:74:fe:d2:49:ce:90:fb:af:a5:39:
+         a6:98:83:c6:51:63:e3:3e:bf:b1:9b:8b:26:bd:34:69:cc:d4:
+         2c:6e:6c:2d:90:01:9b:3c:4c:9d:cc:4f:f4:86:2a:44:92:2e:
+         ab:ac:eb:e0:55:6d:50:cf:0d:52:ac:d5:3f:3e:36:4e:21:61:
+         ee:2f:40:a2:52:be:42:f6:81:aa:c3:9f:4a:6c:68:02:1c:8b:
+         63:e1:ec:8e
 -----BEGIN CERTIFICATE-----
 MIIEETCCAvmgAwIBAgIBATANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
 cnQxCzAJBgNVBAYTAkZJMREwDwYDVQQIDAhIZWxzaW5raTERMA8GA1UEBwwISGVs
-c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTcwNDI1MjA1MjIxWhcNMzcwNDIw
-MjA1MjIxWjCCAUcxCzAJBgNVBAYTAkZJMWEwXwYDVQQIDFhzdGF0ZSBvciBwcm92
+c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTkwNDI0MTQyOTM5WhcNMzkwNDE5
+MTQyOTM5WjCCAUcxCzAJBgNVBAYTAkZJMWEwXwYDVQQIDFhzdGF0ZSBvciBwcm92
 aW5jZSB3aXRoaW4gY291bnRyeSwgaW4gb3RoZXIgY2VydGlmaWNhdGVzIGluIHRo
 aXMgZmlsZSBpdCBpcyB0aGUgc2FtZSBhcyBMMUAwPgYDVQQHDDdsb2NhdGlvbiwg
 dXN1YWxseSBhbiBhZGRyZXNzIGJ1dCBvZnRlbiBhbWJpZ3VvdXNseSB1c2VkMTQw
 MgYDVQQKDCtvcmdhbml6YXRpb24gbmFtZSwgdHlwaWNhbGx5IGEgY29tcGFueSBu
 YW1lMUkwRwYDVQQLDEBvcmdhbml6YXRpb25hbCB1bml0IG5hbWUsIGEgZGl2aXNp
 b24gbmFtZSB3aXRoaW4gYW4gb3JnYW5pemF0aW9uMRIwEAYDVQQDDAlsb2NhbGhv
-c3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMn+gz8LOIkdQxWTXCa5gGVB
-vS9jZl7b+jMg2cfhNfMUPMi09wnY9bVEj2t+oKQ7RV/m9A8IZ/haTEnk5TkxaYzP
-JXiTpn9Y6ZCcYcsuFLFXshWc6o1vliD+Ke0scbhPH+AFbASxfuC8Qo6/lV6pXsnJ
-pGTCH1mUFMIGRHm80mUtAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN
-BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBTLIjvm
-2rg9fjlhGDhQyE20yJo+KzAfBgNVHSMEGDAWgBQcxyuqG7G7Lpr0D7GGYFc4wkEF
-EjANBgkqhkiG9w0BAQsFAAOCAQEAjrc9zCvlJ0lJWtQ8g5svfRHeaw+0UQLkN9DE
-tXtL40KTdTLR60GiJ/5Nka4roIs7f+kbR4Vzn7cFdDTrYhLY8iRqtCRYempVPrpU
-+VHeVA4ZBvYBIzIKbIHiV4qeccW6ysMPGNTvVEvh7nw6803Do0Qhn8jvhQGr/ql7
-NgUQJV5huB18QIpdW8G7fHlFboRjtT9R6ZxXAd4tHoXLg/AWbXi7EgGl5aKngPpU
-j5pc3hxSor0ASeQEZTD5ufxPlOLYOYm2paUt2yWjDVv54SoTGV7XGjOJW6y9KSba
-GpB+CBndWUtQ/UbDC5Ezi8Zw0SIYN6OL04/4aM84juHvrBeIyg==
+c3QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALZCoF4eBV5/Fb98pNbHqM3M
+2/TE5W3zU0eQe9LW2Q1FfGKqgWQ9uNspHwyvNWnTgnpmhnuXzg9UoXyulwwLeh7M
+YLvFu6FH08gioHkRLAmF8i2+JFpziNhFvG3SnnuNnVXywR7mzSCgi7Q7hQxLBrPV
+HlEfper8gXTGvVn4gTUFAgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgEN
+BB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBQu6Y3a
+Vf53NPAP8AcCMXx93tQM1TAfBgNVHSMEGDAWgBTzHaBfaTOKpLR2l6Juq/2gv/Ms
+zjANBgkqhkiG9w0BAQsFAAOCAQEAjoBzmCFpRJp16QjsU/pIhGs2ZtaEDRzQicie
+WQszZC2S7qPxyaRfUl+zOdk2mg2bRHlyJ4EGi7u37PLUI8oDCxlExWSaDum1Stu7
+ekdlX74AJQtnQq06ibrnl8GI3SJJVyE9/sPoq3Bs0aN9PqyP1affTlree3FgFqhc
+yDua+YaSJ66bc/sP8AnQnfAq31SGRLUpr5PTA/pIckRphdOf1X9cTDCv5zcL2yl0
+/tJJzpD7r6U5ppiDxlFj4z6/sZuLJr00aczULG5sLZABmzxMncxP9IYqRJIuq6zr
+4FVtUM8NUqzVPz42TiFh7i9AolK+QvaBqsOfSmxoAhyLY+Hsjg==
 -----END CERTIFICATE-----

mysql-test/std_data/server-key.pem

 -----BEGIN RSA PRIVATE KEY-----
-MIICXQIBAAKBgQDJ/oM/CziJHUMVk1wmuYBlQb0vY2Ze2/ozINnH4TXzFDzItPcJ
-2PW1RI9rfqCkO0Vf5vQPCGf4WkxJ5OU5MWmMzyV4k6Z/WOmQnGHLLhSxV7IVnOqN
-b5Yg/intLHG4Tx/gBWwEsX7gvEKOv5VeqV7JyaRkwh9ZlBTCBkR5vNJlLQIDAQAB
-AoGAZzoeMJW3arr9kYUhTtj1+MlDuXf+1PNuRbrAERnSzErHVXrF1M5/owdKlBC+
-X6+6oGwSxavyFkVvP0QusK/D1DxSs60Mk1p3Ax5nVpNYiBdeBULcYiXCSUbKItYL
-vzyECIc02t+auWf/wp3Wy3g6sU6FoT2QCPSsy0qRC48VBzECQQD79P9w0XjJGk8y
-3zPc4JOr3a1UUu4VLjFdFDR2eZZRE02NcXfLHE0+Idk3TYnNDRLoWDJjdfZ0thZZ
-KuJ58wIDAkEAzTxGYmT/aieDC3G8sHMqLUvjN30TfTocv7mWlpxWo7zbRbQm7jsB
-S5weRKtu3yVmdb6rW+5IZSCazc/j4T5tDwJAUgDRSpTCrSFE+Zevt4nYRi2mBjXf
-i0E3i8XRtWWpSMXxjcGKba7ObRRzMA6qdPR2XOynqbtw9Vd2Ops8jthKpQJBAJJm
-8tZxsXlqIiLhyXYdUPLq9XS5tlNYRvXFT9S0RWGb8NbyQesjEDN9dGIL4JUxurs3
-fkmf2ui4r3UtXSNqQqUCQQDjatAhBdibh5UawO5VpI87OJMzATCkY/mX3R+TnbOm
-MkdydjF022P0M4N24DiM+2nBTDp+F45LwtQLa4vmB2No
+MIICWwIBAAKBgQC2QqBeHgVefxW/fKTWx6jNzNv0xOVt81NHkHvS1tkNRXxiqoFk
+PbjbKR8MrzVp04J6ZoZ7l84PVKF8rpcMC3oezGC7xbuhR9PIIqB5ESwJhfItviRa
+c4jYRbxt0p57jZ1V8sEe5s0goIu0O4UMSwaz1R5RH6Xq/IF0xr1Z+IE1BQIDAQAB
+AoGAdQJNJl8rn0EDW03QHbtMmeL9CyUlDfN68aTGedNIwYZsloNUUmB1vu2la2VI
+a0pIqAAOMmaA+cKhcgQ8IJV1rh11BgiRhwJZJNRY1EYik5rEgJCYivlQo3PiDUhR
+6l3t4xEmSswXyOj9WCo8kKJdjalERNDavLhXHa/SnQnSpzkCQQDtreVj+DIzRcJp
+IaZvIlnVeDb+ZB3903DzXJLT4cqwmi2TuVBT6RkE4lnYAAIfQxedMfayLKzHTvse
+aP4vvvRfAkEAxE8m27MngLZUyje9WwnbtXDUOALBNnGz3KE+qD6UN+a8qCJAJSJ5
+oJBpZU3ZDRKZaiIUOtQsMOonjB6wFrDxGwJANRnu8CDZhl8Filt8RcQU8f6Dut4/
+XSBKUfTS0QfXMxGfMSvr6HNhpZe0nu+Ric6BjhtFlJUqnPTmYervL1eoXQJAChm4
+eh1hrvGysyTjDUgYkeFYSfl6T37SLkvtmWJ+5dFta4k3m7GGaIiFo7y5qj6Gvjs6
+pzw7edjSaBc8IC7CeQJADBoy86mlLSUi7OzNz7xp3f2E1HUmjARFP72PW3FAosoU
+GCsVCFeBZDSREZoQHB4CQZhjLFYkbBeVwFVOW/Jxjg==
 -----END RSA PRIVATE KEY-----

mysql-test/std_data/serversan-cert.pem

@@ -5,56 +5,56 @@ Certificate:
     Signature Algorithm: sha256WithRSAEncryption
         Issuer: CN=cacert, C=FI, ST=Helsinki, L=Helsinki, O=MariaDB
         Validity
-            Not Before: Apr 25 20:52:33 2017 GMT
-            Not After : Apr 20 20:52:33 2037 GMT
+            Not Before: Apr 24 14:29:50 2019 GMT
+            Not After : Apr 19 14:29:50 2039 GMT
         Subject: C=FI, ST=Helsinki, L=Helsinki, O=MariaDB, CN=server
         Subject Public Key Info:
             Public Key Algorithm: rsaEncryption
                 Public-Key: (1024 bit)
                 Modulus:
-                    00:a7:74:d4:2b:80:cb:96:08:2a:b9:c2:87:18:0d:
-                    69:2b:da:cf:ef:21:cb:05:d4:80:2c:f3:85:bc:78:
-                    b2:42:d9:9f:f1:dc:47:68:c5:af:5a:c9:01:f0:dd:
-                    91:cb:3a:b9:38:b2:36:6b:a3:66:ef:cd:44:0f:8f:
-                    39:57:60:ad:3b:44:33:51:c2:7f:cb:5c:8d:55:b8:
-                    1e:e8:80:e0:ed:9d:8d:10:7a:42:68:73:06:63:83:
-                    ce:db:05:5b:e1:7b:f9:0e:87:20:38:b8:11:6a:b7:
-                    59:3d:4a:ca:cb:60:e6:e1:73:d9:a2:24:4a:70:93:
-                    5e:cf:d5:04:d5:ad:ac:96:a5
+                    00:c4:ca:f5:53:66:e9:f7:48:39:dc:8c:d7:06:f4:
+                    03:3b:87:11:8e:8f:4d:a1:2b:b7:2a:38:37:6c:a2:
+                    34:2f:d4:9d:84:78:99:7f:6b:ec:c3:63:ea:e8:9c:
+                    57:af:a4:78:cf:59:5f:79:6b:29:11:2c:be:16:56:
+                    8f:7b:76:57:c9:36:d5:7f:58:10:f3:d1:c2:dc:09:
+                    17:f2:7b:fa:2d:71:c2:50:15:92:af:a0:58:32:f0:
+                    64:60:d3:9a:c6:3c:8a:31:e0:b6:b2:9f:29:7d:97:
+                    87:3c:62:bf:e6:8e:e7:2f:4a:ac:f7:fe:93:38:bc:
+                    86:d4:87:91:38:2d:ed:e2:0d
                 Exponent: 65537 (0x10001)
         X509v3 extensions:
             X509v3 Subject Alternative Name: 
-                DNS:localhost
+                IP Address:127.0.0.1, DNS:localhost
     Signature Algorithm: sha256WithRSAEncryption
-         4b:78:d9:09:4c:25:cc:fb:17:8f:31:13:ac:d7:36:2d:5f:d4:
-         ce:94:84:d2:a7:fa:e2:1e:ae:b6:72:1f:01:56:0f:89:80:c0:
-         01:ba:ad:d7:cb:24:c5:25:ec:f8:35:ac:52:1b:4f:af:7c:26:
-         8d:d4:d4:91:05:21:b7:ba:3f:6b:1b:8d:1d:a5:6b:7e:7d:be:
-         2f:6a:09:83:c2:c3:6c:2f:8a:31:fa:7b:36:3f:6d:e1:62:ca:
-         a0:3c:43:b8:53:5a:4a:b3:4d:7a:cb:9c:6e:db:a4:ce:a1:95:
-         5e:26:d8:22:39:8c:34:0e:92:bd:87:a2:b1:7a:68:25:57:17:
-         b2:d8:43:3b:98:e4:80:6b:7d:3e:ab:32:82:6d:b8:80:45:83:
-         d6:55:f8:cd:31:74:17:8c:42:75:09:71:66:b9:e0:94:16:ca:
-         1d:db:1e:89:12:a1:9f:00:cb:83:99:5d:5d:28:7a:df:2a:87:
-         b5:8d:f1:9c:b9:89:2a:0d:6c:af:61:00:41:cb:03:df:99:4a:
-         fe:93:81:88:ff:47:4e:2a:b5:2b:bf:85:0f:9a:21:7b:20:58:
-         7a:1c:67:b5:8b:da:db:03:69:25:db:76:0e:f9:23:57:8d:8a:
-         47:dc:15:16:7c:2d:66:8f:6a:10:f3:b2:ea:2e:31:c6:d4:2c:
-         90:15:56:f4
+         c5:83:b2:bb:a3:3b:a9:42:df:de:30:db:09:90:e1:3e:7a:19:
+         09:4b:82:a3:1d:e8:23:3f:61:46:b7:98:b3:2e:90:61:7f:c5:
+         a1:36:a6:3e:b0:5b:3f:a1:23:70:7d:0f:71:5b:13:0f:be:73:
+         1b:31:1a:b3:ce:f7:59:aa:b4:18:8d:37:e1:8c:07:af:10:18:
+         4e:37:16:b2:67:73:5b:79:c6:30:16:ab:62:c5:c2:3e:72:06:
+         fd:b2:2a:f5:92:99:32:7e:ed:65:7e:bd:b2:74:9d:38:d4:d5:
+         35:f8:06:dd:ac:85:75:e7:c2:6b:16:e8:2f:0f:c4:d3:b7:e7:
+         be:b6:cd:61:7b:29:e6:3a:c2:7c:38:46:fb:2c:a3:da:fe:84:
+         5f:79:99:2f:80:3e:ec:09:88:f4:31:cd:5c:d1:32:a1:9f:1f:
+         55:f2:9b:c6:4e:b2:26:04:9b:ee:04:42:d2:40:88:0e:c8:cf:
+         e0:6e:06:a1:6a:c8:1a:62:d0:7a:a4:19:4d:9c:e4:b6:57:e2:
+         1d:19:57:54:58:1b:cc:bf:b8:29:e2:15:1e:f1:96:be:30:9e:
+         4c:05:f9:90:e3:a1:7b:d7:e0:63:a6:d1:25:b1:80:81:f3:1b:
+         55:4f:c1:64:9f:a1:06:01:8c:9a:15:64:b9:12:96:a8:22:4b:
+         4a:d9:e3:04
 -----BEGIN CERTIFICATE-----
-MIICuzCCAaOgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
+MIICwTCCAamgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBWMQ8wDQYDVQQDDAZjYWNl
 cnQxCzAJBgNVBAYTAkZJMREwDwYDVQQIDAhIZWxzaW5raTERMA8GA1UEBwwISGVs
-c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTcwNDI1MjA1MjMzWhcNMzcwNDIw
-MjA1MjMzWjBWMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
+c2lua2kxEDAOBgNVBAoMB01hcmlhREIwHhcNMTkwNDI0MTQyOTUwWhcNMzkwNDE5
+MTQyOTUwWjBWMQswCQYDVQQGEwJGSTERMA8GA1UECAwISGVsc2lua2kxETAPBgNV
 BAcMCEhlbHNpbmtpMRAwDgYDVQQKDAdNYXJpYURCMQ8wDQYDVQQDDAZzZXJ2ZXIw
-gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKd01CuAy5YIKrnChxgNaSvaz+8h
-ywXUgCzzhbx4skLZn/HcR2jFr1rJAfDdkcs6uTiyNmujZu/NRA+POVdgrTtEM1HC
-f8tcjVW4HuiA4O2djRB6QmhzBmODztsFW+F7+Q6HIDi4EWq3WT1Kystg5uFz2aIk
-SnCTXs/VBNWtrJalAgMBAAGjGDAWMBQGA1UdEQQNMAuCCWxvY2FsaG9zdDANBgkq
-hkiG9w0BAQsFAAOCAQEAS3jZCUwlzPsXjzETrNc2LV/UzpSE0qf64h6utnIfAVYP
-iYDAAbqt18skxSXs+DWsUhtPr3wmjdTUkQUht7o/axuNHaVrfn2+L2oJg8LDbC+K
-Mfp7Nj9t4WLKoDxDuFNaSrNNesucbtukzqGVXibYIjmMNA6SvYeisXpoJVcXsthD
-O5jkgGt9Pqsygm24gEWD1lX4zTF0F4xCdQlxZrnglBbKHdseiRKhnwDLg5ldXSh6
-3yqHtY3xnLmJKg1sr2EAQcsD35lK/pOBiP9HTiq1K7+FD5oheyBYehxntYva2wNp
-Jdt2DvkjV42KR9wVFnwtZo9qEPOy6i4xxtQskBVW9A==
+gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMTK9VNm6fdIOdyM1wb0AzuHEY6P
+TaErtyo4N2yiNC/UnYR4mX9r7MNj6uicV6+keM9ZX3lrKREsvhZWj3t2V8k21X9Y
+EPPRwtwJF/J7+i1xwlAVkq+gWDLwZGDTmsY8ijHgtrKfKX2Xhzxiv+aO5y9KrPf+
+kzi8htSHkTgt7eINAgMBAAGjHjAcMBoGA1UdEQQTMBGHBH8AAAGCCWxvY2FsaG9z
+dDANBgkqhkiG9w0BAQsFAAOCAQEAxYOyu6M7qULf3jDbCZDhPnoZCUuCox3oIz9h
+RreYsy6QYX/FoTamPrBbP6EjcH0PcVsTD75zGzEas873Waq0GI034YwHrxAYTjcW
+smdzW3nGMBarYsXCPnIG/bIq9ZKZMn7tZX69snSdONTVNfgG3ayFdefCaxboLw/E
+07fnvrbNYXsp5jrCfDhG+yyj2v6EX3mZL4A+7AmI9DHNXNEyoZ8fVfKbxk6yJgSb
+7gRC0kCIDsjP4G4GoWrIGmLQeqQZTZzktlfiHRlXVFgbzL+4KeIVHvGWvjCeTAX5
+kOOhe9fgY6bRJbGAgfMbVU/BZJ+hBgGMmhVkuRKWqCJLStnjBA==
 -----END CERTIFICATE-----

mysql-test/std_data/serversan-key.pem

 -----BEGIN PRIVATE KEY-----
-MIICdgIBADANBgkqhkiG9w0BAQEFAASCAmAwggJcAgEAAoGBAKd01CuAy5YIKrnC
-hxgNaSvaz+8hywXUgCzzhbx4skLZn/HcR2jFr1rJAfDdkcs6uTiyNmujZu/NRA+P
-OVdgrTtEM1HCf8tcjVW4HuiA4O2djRB6QmhzBmODztsFW+F7+Q6HIDi4EWq3WT1K
-ystg5uFz2aIkSnCTXs/VBNWtrJalAgMBAAECgYBReSgZmmpzLroK8zhjXXMEIUv1
-3w02YvOR61HwJxEkMVn+hNxBf50XoKDPHh5nMMUZbqvHpxLYLZilsVuGxcTCPVzw
-YxTooPcJY8x61oUclI2Ls5czu/OfzoJhA9ESaFn6e4xReUFmNi8ygTMuPReZZ90T
-ZvDikonKtCCk99MSaQJBANrmlPtfY57KJ18f1TqLvqy73I1vQjffSOrK3deYbvvB
-jUJ79G9Wzj8Hje2y+XkkK+OIPcND1DnoTCTuqVazn+cCQQDD1jy8zrVg/JEPhQkS
-BM7nvm4PIb0cgTPrOhsHDIF4hbaAZnA0N4ZEJ2q7YitXfOeR98x+aH/WJOrzzhmE
-VXOTAkBQ4lK6b4zH57qUk5aeg3R5LxFX0XyOWJsA5uUB/PlFXUdtAZBYc6LR92Ci
-LDeyY4M0F+t6c12/5+3615UKzGSRAkA+SGV6utcOqGTOJcZTt7nCFFtWbqmBZkoH
-1qv/2udWWFhJj8rBoKMQC+UzAS69nVjcoI2l6kA17/nVXkfZQYAHAkEAmOHCZCVQ
-9CCYTJICvoZR2euUYdnatLN8d2/ARWjzcRDTdS82P2oscATwAsvJxsphDmbOmVWP
-Hfy1t8OOCHKYAQ==
+MIICdQIBADANBgkqhkiG9w0BAQEFAASCAl8wggJbAgEAAoGBAMTK9VNm6fdIOdyM
+1wb0AzuHEY6PTaErtyo4N2yiNC/UnYR4mX9r7MNj6uicV6+keM9ZX3lrKREsvhZW
+j3t2V8k21X9YEPPRwtwJF/J7+i1xwlAVkq+gWDLwZGDTmsY8ijHgtrKfKX2Xhzxi
+v+aO5y9KrPf+kzi8htSHkTgt7eINAgMBAAECgYAKFt29COm1494TkKT1lk0UIDim
+NnKkcLlTUM6Go0pJqXzp7cTw43egDN9eTaWxO512A/8BGp1gZAra2lVA3zBg6Yqb
+QYJwT2s/DsCwFU0msw1sUr5ynJ4A/jQCwR6RzaP2xoJTPaczpoE+RiOmgvQ14GF4
+sJEfAIJCw5OglICTgQJBAOK3yeiMSF6ic8OORkOHy8LdQAFGOsKwliQltxzvRXYZ
+dWlHHAX+9l6rVC+o0rbooO4QEfJHn9ojjROr5+iIn2cCQQDeNbljgN+6K36r9Qmh
+fuBy2Ot+wRO30T4ASFelgJ0aHYEngSGSRneMmbbgDFx7v7Y9k6yY9RPiSqYX+vCQ
+425rAkAjfkpp0axyxFQDRX7Si6vmseSXTntch3C57/2e1ga12n57INrORYAkigYA
+ABoc8IZhPrrQh04LRI2Nitgfm2P5AkBmqEFGk/JIKvHxdVoGrvv4cviQ7ZgzcsqH
+DOTZBAsQVpMlcgXVcxKl9RnEdlF/pjkGR6QUYhzWjZAgQgFDnp6TAkBqIXYMvyp7
+JRfbnhze+UBgjeCoE/wTv/DiXL1yi4uVVVm8luToFv9DPAyvms/guJ7Ade5HDHye
+M/LZbE37/NYP
 -----END PRIVATE KEY-----

mysql-test/suite.pm

@@ -72,10 +72,15 @@ sub skip_combinations {
     unless $::mysqld_variables{'version-ssl-library'} =~ /OpenSSL (\S+)/
        and $1 ge "1.0.1d";
 
+
   $skip{'t/ssl_7937.combinations'} = [ 'x509v3' ]
     unless $::mysqld_variables{'version-ssl-library'} =~ /OpenSSL (\S+)/
        and $1 ge "1.0.2";
 
+  $skip{'t/ssl_verify_ip.test'} = 'x509v3 support required'
+    unless $::mysqld_variables{'version-ssl-library'} =~ /OpenSSL (\S+)/
+       and $1 ge "1.0.2";
+
   %skip;
 }
 

mysql-test/t/ssl_verify_ip.opt

+--loose-enable-ssl
+--loose-ssl-cert=$MYSQL_TEST_DIR/std_data/serversan-cert.pem
+--loose-ssl-key=$MYSQL_TEST_DIR/std_data/serversan-key.pem

mysql-test/t/ssl_verify_ip.test

+source include/have_ssl_crypto_functs.inc;
+--exec $MYSQL --protocol=tcp --host=127.0.0.1 --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl --ssl-verify-server-cert -e "select 1"
+--exec $MYSQL --protocol=tcp --host=localhost --ssl-ca=$MYSQL_TEST_DIR/std_data/cacert.pem --ssl --ssl-verify-server-cert -e "select 1"

sql-common/client.c

@@ -1838,8 +1838,10 @@ static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const c
   */
 
 #ifdef HAVE_X509_check_host
-  ret_validation= X509_check_host(server_cert, server_hostname,
-                                  strlen(server_hostname), 0, 0) != 1;
+  ret_validation=
+   (X509_check_host(server_cert, server_hostname,
+       strlen(server_hostname), 0, 0) != 1) &&
+   (X509_check_ip_asc(server_cert, server_hostname, 0) != 1);
 #else
   subject= X509_get_subject_name(server_cert);
   cn_loc= X509_NAME_get_index_by_NID(subject, NID_commonName, -1);