Fix NoHostnameTlsVerifier for rustls 0.23.24 and above (#3861)

elichai · web-flow · commit 2970559e256f · 2025-07-02T03:48:51.000-07:00
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/sqlx-core/Cargo.toml b/sqlx-core/Cargo.toml
@@ -48,7 +48,7 @@ tokio = { workspace = true, optional = true }
 # TLS
 native-tls = { version = "0.2.10", optional = true }
 
-rustls = { version = "0.23.15", default-features = false, features = ["std", "tls12"], optional = true }
+rustls = { version = "0.23.24", default-features = false, features = ["std", "tls12"], optional = true }
 webpki-roots = { version = "0.26", optional = true }
 rustls-native-certs = { version = "0.8.0", optional = true }
 
diff --git a/sqlx-core/src/net/tls/tls_rustls.rs b/sqlx-core/src/net/tls/tls_rustls.rs
@@ -309,9 +309,9 @@ impl ServerCertVerifier for NoHostnameTlsVerifier {
             ocsp_response,
             now,
         ) {
-            Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)) => {
-                Ok(ServerCertVerified::assertion())
-            }
+            Err(TlsError::InvalidCertificate(
+                CertificateError::NotValidForName | CertificateError::NotValidForNameContext { .. },
+            )) => Ok(ServerCertVerified::assertion()),
             res => res,
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -309,9 +309,9 @@ impl ServerCertVerifier for NoHostnameTlsVerifier {`
`309`	`309`	`ocsp_response,`
`310`	`310`	`now,`
`311`	`311`	`) {`
`312`		`- Err(TlsError::InvalidCertificate(CertificateError::NotValidForName)) => {`
`313`		`- Ok(ServerCertVerified::assertion())`
`314`		`- }`
	`312`	`+ Err(TlsError::InvalidCertificate(`
	`313`	`+ CertificateError::NotValidForName \| CertificateError::NotValidForNameContext { .. },`
	`314`	`+ )) => Ok(ServerCertVerified::assertion()),`
`315`	`315`	`res => res,`
`316`	`316`	`}`
`317`	`317`	`}`