tls: handle multiple CN fields when verifying cert

Fixes #3861.

1 files changed, 8 insertions, 1 deletions

diff --git a/lib/tls.js b/lib/tls.js
index 05e48d03a97..71a2724e149 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -154,7 +154,14 @@ function checkServerIdentity(host, cert) {
 
     // And only after check if hostname matches CN
     // (because CN is deprecated, but should be used for compatiblity anyway)
-    dnsNames.push(regexpify(cert.subject.CN, false));
+    var commonNames = cert.subject.CN;
+    if (Array.isArray(commonNames)) {
+      for (var i = 0, k = commonNames.length; i < k; ++i) {
+        dnsNames.push(regexpify(commonNames[i], false));
+      }
+    } else {
+      dnsNames.push(regexpify(commonNames, false));
+    }
 
     valid = dnsNames.some(function(re) {
       return re.test(host);