From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 1 Sep 2026 09:13:17 +0000 (+0000)
Subject: REGTESTS: ssl: add verifyhost SAN vs CN matching test
X-Git-Tag: v3.5-dev6~31
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=62180d86176e5266c581fee2e6d66dfc797fef5f;p=haproxy.git

REGTESTS: ssl: add verifyhost SAN vs CN matching test

Add a VTC test to check that backend certificate verification in
ssl_sock_srv_verifycbk() adheres to RFC 6125:

1. A certificate with a matching SAN dNSName is accepted.
2. A legacy certificate without any SAN extension falls back to the
   Subject CN and is accepted.
3. A certificate with a non-matching SAN dNSName is rejected, even if
   its Subject CN matches the expected hostname.

The test uses dedicated static certificates in reg-tests/ssl/certs/
(verifyhost_ca.crt and associated leaf certificates) so that
certificates do not need to be generated at runtime.
---

diff --git a/reg-tests/ssl/certs/verifyhost_ca.crt b/reg-tests/ssl/certs/verifyhost_ca.crt
new file mode 100644
index 000000000..dda895b5a
--- /dev/null
+++ b/reg-tests/ssl/certs/verifyhost_ca.crt
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDFjCCAf6gAwIBAgIUYpX8M/+9NMtMRFpVFwut13p3ZgowDQYJKoZIhvcNAQEL
+BQAwIjEgMB4GA1UEAwwXVmVyaWZ5aG9zdCBUZXN0IFJvb3QgQ0EwIBcNMjYwOTAx
+MDg0NTMwWhgPMjA1NDAxMTcwODQ1MzBaMCIxIDAeBgNVBAMMF1ZlcmlmeWhvc3Qg
+VGVzdCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmcQ0
+sjFZtmij9SPdfzMoD33qx14w9eeO6Q8+nUeEMWPQ1B7MDZGr5TmZytdfQjhbXkjC
+HNKAhYCgFUWCIP0soQJHBu5CtS5P5ZcTH0EXRbxgkTvX4AT527lsUz0DulTl5Vfr
+AxzcGCXiUFji1BE7C4QqUcyBffLPklO3xTLQ3vhx+6R84Aa9oeokvWJQS4A+Dy9S
+t4wpaF8bPgaRrs0iRSOzRfAlcNTpbb9dQC+RxT+FnJaUWHs/UZHA50s/bEMNXUiO
+XvmNKBk+KuBKsyk74t1bSq379ERc8tLr1LIpqXZeM3gOmC8/H3wDMEtNSJ/FEmBY
+RUX1CAVmdPA5Qdrm6QIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB
+/wQEAwIBBjAdBgNVHQ4EFgQUjcrImQIE9HTqKpt/8hoLwd3zYmQwDQYJKoZIhvcN
+AQELBQADggEBAHW4CJ0b3a2+CGuBsy44uKNqIcXaZTQj9pf5lFfS9h9P/JhWSXWq
+FHasak2w/LSWpYFMVFi42QZVcSQPQUWsBh79G84D+eDiv22FzyuMNJFDPSwHLTaD
+io0S/t4enhhHIZ2pL3Ma5yp/uF0wMG0MfRmbs/OzWZEft0mAkO0HxWQUxB0rinQv
+q5Uo8UFb6pHfn4MEgNpafBNRs9ZaR+nUkc5WrAQB/YuB4rlXU3poY6XJvrVueUHx
+sW2WZO/cUGyFBDFF7YUbIIHg0NAp5bmglCpSSW0EorQ5Ok39fT8ECXYoaH5AIrp1
+WgNa5HGzxJcymr1tUIAk9ozZ7eEleYwNZ+4=
+-----END CERTIFICATE-----
diff --git a/reg-tests/ssl/certs/verifyhost_no_san.pem b/reg-tests/ssl/certs/verifyhost_no_san.pem
new file mode 100644
index 000000000..ebc336ea8
--- /dev/null
+++ b/reg-tests/ssl/certs/verifyhost_no_san.pem
@@ -0,0 +1,47 @@
+-----BEGIN CERTIFICATE-----
+MIIDEjCCAfqgAwIBAgIUUYnobCvMlKKf00exsH1Q5TNX3rYwDQYJKoZIhvcNAQEL
+BQAwIjEgMB4GA1UEAwwXVmVyaWZ5aG9zdCBUZXN0IFJvb3QgQ0EwIBcNMjYwOTAx
+MDg0NTMxWhgPMjA1NDAxMTcwODQ1MzFaMB4xHDAaBgNVBAMME2JhY2tlbmQuZXhh
+bXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDka3l88e2N
+TCodF/laJlb/M1NAsk/pvbbn6kTlebLiA2YGIEAjZi7ryiyA9K24IyMTxaBpuC1t
+UfYV6Pd2Pnf/mgpYxNZKRpeXfofWCOqglxuxj6lgvkgpnHkpk5OObxJDKtMvvzhx
+okYN/UDlxKdg1llD2wrUd1bYOXLFt0+pXfjaG7CSD94klKm8RB6YTbcX1i+fdRJh
+l4Ekyna4zAl+nV4z5qOZymG68GQK2LWTamQUB8ErRnJCKOgvEI4OofjvaIzoZkZY
+9iWc4MHEKOkMJB2q0vh1pXKXiVThd9pblnM6GyzgGf+qzty3cKcos1REz9yBfF/Y
+4ZPoJ5tK0xK5AgMBAAGjQjBAMB0GA1UdDgQWBBT+GpSrbwSGEWKFkojZgfl4j5ng
+EjAfBgNVHSMEGDAWgBSNysiZAgT0dOoqm3/yGgvB3fNiZDANBgkqhkiG9w0BAQsF
+AAOCAQEAH28eCmPEpz4GY6hL06Tr3QVBfzib4D7LLbWYG61cwFqvTluq1Wh4ykdg
+pBvbHAVPKtPxiHx01y2pZ2vPV41GCQ8enW6Q38gURm7/ChSz44sxgNlBlA0MvmSz
+g8rhzeBzXrhasu62WiznFf5CD9yG1O2DwN/vcad46FtLVSFNWOrQLZsyKO+Jcosu
+rGUpyKO0rCRV4mUII8uJdQZk+r7WIDEVh+Gazb+XtUegHG/U0jG2PGKVW6+uELD3
+LsvdMhYy2HSle0PDjuTYpf8uaMkvxsu1FCTs155t/6qrdZmC6bmLhaAQ1dqVO0s+
+YmGrbUaiwQdUILI4egGmlxeiBH1UNg==
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDka3l88e2NTCod
+F/laJlb/M1NAsk/pvbbn6kTlebLiA2YGIEAjZi7ryiyA9K24IyMTxaBpuC1tUfYV
+6Pd2Pnf/mgpYxNZKRpeXfofWCOqglxuxj6lgvkgpnHkpk5OObxJDKtMvvzhxokYN
+/UDlxKdg1llD2wrUd1bYOXLFt0+pXfjaG7CSD94klKm8RB6YTbcX1i+fdRJhl4Ek
+yna4zAl+nV4z5qOZymG68GQK2LWTamQUB8ErRnJCKOgvEI4OofjvaIzoZkZY9iWc
+4MHEKOkMJB2q0vh1pXKXiVThd9pblnM6GyzgGf+qzty3cKcos1REz9yBfF/Y4ZPo
+J5tK0xK5AgMBAAECggEAAKPgd54snpcWYyB8aBPwGHpUrbtnh+3VLmSKBDlJbA1l
+uCICVqxkTfAyHGZoejn2+4jeleKYlf7YeV/pbvZmhbExKDsyUouiGcrr/IiSh8Kv
+UYRn4sfbEerIrXomvAvJpFCME6KDOPujG0pDZ/bGH/pZzlvgdY9Ouf+8jPCiPi+Y
+4Igi7l8T7IKDp69BrJel54fPlJO2N3CeU8wX/DfZtzl6f8KnQslx2QBo+l2mUiWl
+sob9uZr6dbr0Xst5xRXaT88ESGIpAPBt/9WejTw9nZw8oVtw4x5oumv8DinBu6o7
+XHZo15atukCTvtSKF64K2SlSnB8YZPsNK2IlWL2x5QKBgQD+HfN/9P5+zNBN2Z7P
+Fx/aFavGXAIcuuPzXhHmfCn1jv50y+MLT/eMZtlxwT693vByAtlI21h4WIJ+B9yL
+i30tVaFVvGgEryDoyeGqHfkq1sbdkAk1Izyom43LNVsWBph3qcmXE02pGGht55Tk
+9OOZABAMb6CwgvQCELzRaeJDnwKBgQDmHMbn5CQCh/C7UVidThZnrYn3W6qJL4bP
+otLigLH3fYVHY56+s7NI29xvHYSRTzxeiuD+N7f9kjC6alJaAZQ2d95Rj7tHGaod
+U8Kelq3cJrPMDa4CqGnudaVicHCKmN+/IDPj22eKtFtJE0tfZkQTuZe15aqleRTa
+LdwQqDNKpwKBgQCXldpJPCYMEbU4m1Zmho7TkxXSz9Pau4l7BWR8LxkAiHo1xeH8
+P4mV0Uxo1TPOI40fFZ/0HBRcRcAh2iKvg1f6kRgagrcyBB4Hf1YEGrkl2tTqGh/D
++O8YTSJ6U6uwKeMNjtTYMAWllw/Eb96b7ZFPFYB9SqF6acOQ79cSvKziVQKBgFTG
+JUEo+1szWayou0y4h+iKNlm6m4kOyUuVYLuxTd8vjvpN6R24dkRRO1R0O3KNDmCG
+KX1+aXoxcWI76TrfegrW/kBuA0CeY92KDhj+ye5hE7wJDiJMiTogfV1Wrx9gUo3G
+/1bibbLb3wV85jevJUVfClUo10U+5j+6xWgdj0fhAoGAfIi121xUnqqmzehMsTiD
+O56hoDb8N+rWAgbWXkES+IghxTNAfowiqlbasq1ZcVTy3n1pxFTJeZvtg+003CNm
+9geeJezOWVjhIyhG6NXZhAsrfzYqHYMi42YwD3iRKHFvZhGpzEVWz3Hmdq1XkVWZ
+tt6RzPW7v6K3i4VkSFnVOfo=
+-----END PRIVATE KEY-----
diff --git a/reg-tests/ssl/certs/verifyhost_san_match.pem b/reg-tests/ssl/certs/verifyhost_san_match.pem
new file mode 100644
index 000000000..e99165821
--- /dev/null
+++ b/reg-tests/ssl/certs/verifyhost_san_match.pem
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgIUUYnobCvMlKKf00exsH1Q5TNX3rUwDQYJKoZIhvcNAQEL
+BQAwIjEgMB4GA1UEAwwXVmVyaWZ5aG9zdCBUZXN0IFJvb3QgQ0EwIBcNMjYwOTAx
+MDg0NTMxWhgPMjA1NDAxMTcwODQ1MzFaMBwxGjAYBgNVBAMMEW90aGVyLmV4YW1w
+bGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuRDeSc0pF9OF
+ZpncNEhDvb/QdGX6kemRFXn/zout2jn9EV1IAYNCmgBwQYsK0S5PGWyUqXr2nace
+L9dMvvge/AKSiW9GtOE0AEHQXQ4jYT2qIpHww3yZEbHAW2AjqRhLW1G+SPPEb1Of
+R/DiMRIR6YCvwwsmZVl2nOJ6LhYC2Sv1sUQCliPZpGIEWQvbYEc0LdMWe6old+FD
+meuq5xldg6Xo4bmwhD+qBh0qDZz9eXRqNHG7IkncKMPkUPJKXTTj8ONn0KFIZY6I
+I7jo4O0ihc+y/8o51OUS4cfjYZ4nclhNWtkVIsMTlMGsoYDAdJ0Pc7H4g3w2ACNM
+QPvNfzkqCwIDAQABo4GQMIGNMB4GA1UdEQQXMBWCE2JhY2tlbmQuZXhhbXBsZS5j
+b20wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
+HQYDVR0OBBYEFH+F8OiQHjs7jmnj2IhDWj1gWBkLMB8GA1UdIwQYMBaAFI3KyJkC
+BPR06iqbf/IaC8Hd82JkMA0GCSqGSIb3DQEBCwUAA4IBAQAr/IbLQVC6+THxi+xc
+7UbuzWbP6u0PXysuMh1IVLTkJOhzWOaP5HVt7BUGb99Jyj67BAjEWM8IlIGlwhcn
+ens6un/rm/AudRnReuNo1wcTJk2wko0uRMBLnx8dHk+r+Zp9Rr4d5T8U7jlrOnIn
+1h6F3rPPERnp79R/vQRyL7GXFSxewEMv0XJ3dIcGWF/3cfHjX2GBOnXHvmUwoZSI
+aNIKJat/9StrT7ovaxDbvAoqKzQhlr55VHLi1VFPXstRsqNpEVXb4rngePpe9CEY
+8SsPcMpB+43s14S0+L4OiEkgorDORy5qcmnlVfxX2uyWSuSEzUvdx5d38sGYi5Tn
+Hzi0
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC5EN5JzSkX04Vm
+mdw0SEO9v9B0ZfqR6ZEVef/Oi63aOf0RXUgBg0KaAHBBiwrRLk8ZbJSpevadpx4v
+10y++B78ApKJb0a04TQAQdBdDiNhPaoikfDDfJkRscBbYCOpGEtbUb5I88RvU59H
+8OIxEhHpgK/DCyZlWXac4nouFgLZK/WxRAKWI9mkYgRZC9tgRzQt0xZ7qiV34UOZ
+66rnGV2DpejhubCEP6oGHSoNnP15dGo0cbsiSdwow+RQ8kpdNOPw42fQoUhljogj
+uOjg7SKFz7L/yjnU5RLhx+NhnidyWE1a2RUiwxOUwayhgMB0nQ9zsfiDfDYAI0xA
++81/OSoLAgMBAAECggEAGJKy0V3afP1rEyqO4KpPxFw505rO4J0A1Lc0TjqhxP46
+KhoWu4ywRT6VqT5LG2dovVl7i9117Y0JJxURbbIIezHkPzd1TgMxIm+auSBtdjX3
+50s1it96e6z8e6WSVpuRNfjuqUUk6htSZP0JK7bYhga+T8mlOYPdigtQadomWquP
+yn7L81wz2bLlt4GIk6tqLv7hgzcliM0oLughiEYWmEz6A1Usq+3mj5nnj2HbvCFI
+ugT/fB5wIqJKpxbiwI9z9muUjl5lxeE/EuEZLfEXeUx4YGYnHKoXD6S73iqPlHY2
+YAIEziLNSrMQAPYpJ/biWf93/PmAY4LloCfsydobIQKBgQDf6eE9yz0Q2fB5Q4QJ
+O6x1Cnr/HLk6cwi+Al76DowtYuWWokVu5rgIkVm31ScpBCmVVeXEPTfyHYdZ5Tzs
+856BgGBmS0Z/a9Dh3BpvUa4gJfrTvx2q22+Z40eKWzj1AK+PCPZmJCLUlQO3zgGV
+aVvyl8xyKGiJKRVcFOkf1hCu4wKBgQDTleL2JvobKmJ/ikkKD8bC1S1cUzaPHfLp
+JHR+8K+VBaPVvVSaEuSULHBkl2GsvlaDz/aXfLIAmxScgH3TzxNHuzB82ElsiM1y
+2jxkSe2YkudbQWxhtGhcK/0Jr6gpPD3AyNeoOUxNbcHClB/ZQbx8FxeJZvoZiodJ
+GlFA0ZyYuQKBgQC1pLiJdY9DVVlkNiYti1A63larD/UfemRUJ/4+YoDK7NiNG3Sy
+I86VfLxIik0rU+ob8EPlrzfsXJIJlhKXsoYaTjdlpJk7Ew6vuuti9OMJx2W0UuzR
+RxRAxYSqs5gAAR9qLH4enB/5Ti1m9WKJf6AMq6I51Zf/9OkT+w6nOfPsuwKBgFix
+bAJjNFRO4Bs2jId7NYZWdj1NZIF5vGmernbHzdJaGuNuChjL8qVqO3LvQjJ3VyzJ
+8ERwMO2wFGPGOPigxSQ8g4bR43VrozOR597iXoamjfTi59vNFDIO/nMg/wzKA9jc
+WApcem+6oo4+KVuZArnBtEwUrqImP6+VKJpTQ6GBAoGATmlkulmt9W2BVVGvXSTY
+pP4IODwunOVSuylBcc4RAT+yKybwk/0R7YJjyHG8qQGguAVIzr6+bYk+kxaqcKC7
+6E07y0T5eihQ0fIj0zRrV+/VCkL/wje/U/q1m+Smb+Dazk3kN/cqG1qXOzj5CybA
+qyYoJnOPkknD1Ig/tnf8G9Q=
+-----END PRIVATE KEY-----
diff --git a/reg-tests/ssl/certs/verifyhost_san_mismatch.pem b/reg-tests/ssl/certs/verifyhost_san_mismatch.pem
new file mode 100644
index 000000000..cd2a36703
--- /dev/null
+++ b/reg-tests/ssl/certs/verifyhost_san_mismatch.pem
@@ -0,0 +1,49 @@
+-----BEGIN CERTIFICATE-----
+MIIDXzCCAkegAwIBAgIUUYnobCvMlKKf00exsH1Q5TNX3rQwDQYJKoZIhvcNAQEL
+BQAwIjEgMB4GA1UEAwwXVmVyaWZ5aG9zdCBUZXN0IFJvb3QgQ0EwIBcNMjYwOTAx
+MDg0NTMwWhgPMjA1NDAxMTcwODQ1MzBaMB4xHDAaBgNVBAMME2JhY2tlbmQuZXhh
+bXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCX0z0dKaDI
+U+uBfCQYWUtZGE/02EPgo9j3J0cUOK2VuAI7XWD2iuz8jnbgBuGiLKf3Dn56xnoS
+r4vwVPuuqvQfISMwXAvbOYSROtEVt/+joXB8HOpMx11QGUDGZy79A+/IhceAbDgL
+0oynKznkiRWFWxNdA8J9n6X7zLw+jcRfsV1NkCLG+oK+hw3Duaiag3nSlpSVDVVS
+a9X818xXTif7oZLrvKFepxC0jwzMToTqg5GNpBNU57d2EN4Iap+m5XP5vSAgc19h
+Ypt0WYg1lxysqsG68m8usqyn7yBrJufitEP7Vi+BeNvliE+WKIbvepUcqsxy0LJf
+OhnhKCpD3QjnAgMBAAGjgY4wgYswHAYDVR0RBBUwE4IRb3RoZXIuZXhhbXBsZS5j
+b20wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
+HQYDVR0OBBYEFMAoi4oqd551SimZ8iw9omObOQC3MB8GA1UdIwQYMBaAFI3KyJkC
+BPR06iqbf/IaC8Hd82JkMA0GCSqGSIb3DQEBCwUAA4IBAQCMSkEAhBTxGxKBvbx8
+9U+tv2yplFrY/RHC/nD1Cz0kUh4RvhBZGIDjQsQCSbIuoIcsGtq6z3lplQfJIItu
+oUKLhxqGDRBILMMt0CjivO/XiEO69adNfDTzT5aLnMAHLnip9MiARRKT1PNwr4QA
+KLXgOURlCM92zNa7oqXW7t7+ALnxKMGpne/QAIsj8B0XaffD241eGeCQ55JYWm7F
+RidMsHOBWDcojkrqB9mn/YbUG13tu0jkB5Ss1Cc9OBLYZvmxIluIGUfNnQBn5bt9
+FTmflGOdihr4ddnz2n53kdg0b6RtSrIAwbIQU0mAan7E6XR6bEVDgVd3ydd73Lfs
+A8q2
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCX0z0dKaDIU+uB
+fCQYWUtZGE/02EPgo9j3J0cUOK2VuAI7XWD2iuz8jnbgBuGiLKf3Dn56xnoSr4vw
+VPuuqvQfISMwXAvbOYSROtEVt/+joXB8HOpMx11QGUDGZy79A+/IhceAbDgL0oyn
+KznkiRWFWxNdA8J9n6X7zLw+jcRfsV1NkCLG+oK+hw3Duaiag3nSlpSVDVVSa9X8
+18xXTif7oZLrvKFepxC0jwzMToTqg5GNpBNU57d2EN4Iap+m5XP5vSAgc19hYpt0
+WYg1lxysqsG68m8usqyn7yBrJufitEP7Vi+BeNvliE+WKIbvepUcqsxy0LJfOhnh
+KCpD3QjnAgMBAAECggEAHyOWocATd3Lq1wRgnNPXpd7cK1Id3dmNGufl5qpXQ+FZ
+J9bXl8lXoNcRX5JZvbrd+khxPXouuF1j3Ld5ZVIvvqC7yGPglKZ/34+KKaOy3Vsz
+qGj/zx6Gr3J2fBrWotMnX1+80sSfXCFjcrflaE+LZ+4NkyK9xak0UGgl5ciK0btM
+cOuojfY0EOOv2IZoyYXIbZD6EMSHTCEO0XpLU855LTt9pbCyo3vwuRM0OFTsWYhA
+ABUSEDmk0Si8XZuH5YhXqBawZeEwp+whEPKRnBYMhFk2oo+4mpNLSsuf+lBlIpSe
+TzPVkHSKmr6pg2qRN4ffNx60YsTPIV207akqMP6xHQKBgQDQq6sri7Zef3w8a0wY
+5OSk7nbnX5PRdZoSAwkAcMa05Wqe6jWd4XUTcPp45W+XGawx9hS0lH0cZ42leaIa
+jGbZNRDcttl4y6nLOR9AujoiuBKv+LDAOh+NrAVYVbR5A+G0I7hDvAdXUXF3HvUj
+F3xQEipQjgmYPdVQmb1vbEioRQKBgQC6Qt/hjjHizd5+kdX0Cttx4F+jbKNdxzIs
+wQCh+r17YI44zerEhWviOBZ7PywqHVrL1Kz5O8eYMbBIN1QOgYkfo/SnzzxbrKWz
+k3GdZKX+rkEvJAn0AjkE8nfdgtjD91RIZ/DeWSOjxQCkpC9GDgErYJur2cjnXvE7
+TB6PalPNOwKBgEGC069NIokSXw+c4/wgyEObdgr3r7GfySoEd+wCe+/I4qtXflO9
+t4LOAmS4K0t1zOC2kBONVqX3QLoFsMXC9HsWtN+GLEpHLlxV56DrllrWDU/ftKX0
+2Xkh21+7MHiZpl9mo2/odSmNsSCjwHQu6GE/Arfdj9eS+ghe6+EyTrE9AoGBAI8S
+sXBLzov+QQsOML+N23TEuhIJcA+n5CW2dyr1NLlhuL1vhwc/yVfyZ2pyYxVSiR0L
+F3c28SE6AcPnJB0kaVUxlsuUBzQQERQ4jMwutMdFyPJSB4c0ceIX8fTn/mPBRy97
+D+1roVG6EL1nFJ0GQuW0Br/hwU3ggwJefRcCwK5jAoGBAL76HlUOSA+r/ES2XDKs
+sDPgGgdsIEi8E/kDWVvidjpuPzt+PeJs48+EAH8sHjveARI1Nbmjf6Wr0tMen3Do
+ks9gHn0gdQJxIVFJewnfm1HwuLpGid7dtXBGFVIoMIeGICav2GIAiAk3gOf+1dTQ
+cJDNX83vxg1+bwBTCt6GIWJb
+-----END PRIVATE KEY-----
diff --git a/reg-tests/ssl/verifyhost_san.vtc b/reg-tests/ssl/verifyhost_san.vtc
new file mode 100644
index 000000000..1bdf88fdf
--- /dev/null
+++ b/reg-tests/ssl/verifyhost_san.vtc
@@ -0,0 +1,79 @@
+#REGTEST_TYPE=bug
+#
+# Check that verifyhost adheres to RFC 6125: when a Subject Alternative Name
+# (SAN) extension of type dNSName is present on a server certificate, HAProxy
+# must verify the hostname using only the SAN entries and must NOT fall back
+# to the Subject Common Name (CN).
+#
+varnishtest "Test verifyhost SAN vs CN matching (issue #3486)"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
+feature ignore_unknown_macro
+
+server s1 -repeat 3 {
+    rxreq
+    txresp -body "response from backend"
+} -start
+
+haproxy h1 -conf {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+        stats socket "${tmpdir}/h1/stats" level admin
+
+    defaults
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    # Listeners simulating backend SSL endpoints
+    listen srv_san_match
+        bind "${tmpdir}/match_ssl.sock" ssl crt "${testdir}/certs/verifyhost_san_match.pem"
+        server s1 ${s1_addr}:${s1_port}
+
+    listen srv_no_san
+        bind "${tmpdir}/nosan_ssl.sock" ssl crt "${testdir}/certs/verifyhost_no_san.pem"
+        server s1 ${s1_addr}:${s1_port}
+
+    listen srv_san_mismatch
+        bind "${tmpdir}/mismatch_ssl.sock" ssl crt "${testdir}/certs/verifyhost_san_mismatch.pem"
+        server s1 ${s1_addr}:${s1_port}
+
+    # Frontends testing HAProxy backend SSL verification with verifyhost
+    frontend fe_test
+        bind "fd@${fe}"
+        use_backend be_san_match    if { path /san-match }
+        use_backend be_no_san       if { path /no-san }
+        use_backend be_san_mismatch if { path /san-mismatch }
+
+    backend be_san_match
+        server srv "${tmpdir}/match_ssl.sock" ssl verify required ca-file "${testdir}/certs/verifyhost_ca.crt" verifyhost backend.example.com no-sni-auto
+
+    backend be_no_san
+        server srv "${tmpdir}/nosan_ssl.sock" ssl verify required ca-file "${testdir}/certs/verifyhost_ca.crt" verifyhost backend.example.com no-sni-auto
+
+    backend be_san_mismatch
+        server srv "${tmpdir}/mismatch_ssl.sock" ssl verify required ca-file "${testdir}/certs/verifyhost_ca.crt" verifyhost backend.example.com no-sni-auto
+} -start
+
+# 1. SAN matches (SAN: backend.example.com, CN: other.example.com) -> should succeed (200)
+client c1 -connect ${h1_fe_sock} {
+    txreq -url "/san-match"
+    rxresp
+    expect resp.status == 200
+} -run
+
+# 2. No SAN extension on cert, CN matches (CN: backend.example.com) -> fallback to CN allowed -> should succeed (200)
+client c2 -connect ${h1_fe_sock} {
+    txreq -url "/no-san"
+    rxresp
+    expect resp.status == 200
+} -run
+
+# 3. SAN is present but mismatched, CN matches (SAN: other.example.com, CN: backend.example.com) -> RFC 6125 forbids CN check -> should fail (503)
+client c3 -connect ${h1_fe_sock} {
+    txreq -url "/san-mismatch"
+    rxresp
+    expect resp.status == 503
+} -run