implement subject alternative names support for SSL connections

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index f950fc3..b4f6bc9
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
***************
*** 60,65 ****
--- 60,66 ----
  #ifdef USE_SSL_ENGINE
  #include <openssl/engine.h>
  #endif
+ #include <openssl/x509v3.h>
  
  static bool verify_peer_name_matches_certificate(PGconn *);
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
*************** wildcard_certificate_match(const char *p
*** 473,479 ****
  
  
  /*
!  *	Verify that common name resolves to peer.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
--- 474,480 ----
  
  
  /*
!  *	Verify that common name or any of the alternative dNSNames resolves to peer.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
*************** verify_peer_name_matches_certificate(PGc
*** 492,499 ****
  
  	/*
  	 * Extract the common name from the certificate.
- 	 *
- 	 * XXX: Should support alternate names here
  	 */
  	/* First find out the name's length and allocate a buffer for it. */
  	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
--- 493,498 ----
*************** verify_peer_name_matches_certificate(PGc
*** 556,565 ****
  			result = true;
  		else
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
  							  peer_cn, conn->pghost);
- 			result = false;
  		}
  	}
  
--- 555,627 ----
  			result = true;
  		else
  		{
+ 			int 				   i;
+ 			int         		   alt_names_total;
+ 			STACK_OF(GENERAL_NAME) *alt_names;
+ 
+ 			/* Get the list and the total number of alternative names. */
+ 			alt_names = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
+ 			if (alt_names != NULL)
+ 				alt_names_total = sk_GENERAL_NAME_num(alt_names);
+ 			else
+ 				alt_names_total = 0;
+ 
+ 			result = false;
+ 
+ 			/*
+ 			 * Compare the alternative names dnsNames identifies against
+ 			 * the originally given hostname.
+ 			 */
+ 			for (i = 0; i < alt_names_total; i++)
+ 			{
+ 				const GENERAL_NAME *name = sk_GENERAL_NAME_value(alt_names, i);
+ 				if (name->type == GEN_DNS)
+ 				{
+ 					int    reported_len;
+ 					int    actual_len;
+ 					char  *dns_namedata,
+ 						  *dns_name;
+ 
+ 					reported_len = ASN1_STRING_length(name->d.dNSName);
+ 					/* GEN_DNS can be only IA5String, equivalent to US ASCII */
+ 					dns_namedata = (char *) ASN1_STRING_data(name->d.dNSName);
+ 
+ 					dns_name = malloc(reported_len + 1);
+ 					memcpy(dns_name, dns_namedata, reported_len);
+ 					dns_name[reported_len] = '\0';
+ 
+ 					actual_len = strlen(dns_name);
+ 					if (actual_len != reported_len)
+ 					{
+ 						/*
+ 						 * Reject embedded NULLs in certificate alternative name to prevent attacks
+ 						 * like CVE-2009-4034.
+ 						 */
+ 						printfPQExpBuffer(&conn->errorMessage,
+ 							  libpq_gettext("SSL certificate's alternative name contains embedded null\n"));
+ 						free(peer_cn);
+ 						free(dns_name);
+ 						sk_GENERAL_NAMES_free(alt_names);
+ 						return false;
+ 					}
+ 					if (pg_strcasecmp(dns_name, conn->pghost) == 0)
+ 						result = true;
+ 
+ 					free(dns_name);
+ 				}
+ 				if (result)
+ 					break;
+ 			}
+ 			if (alt_names != NULL)
+ 				sk_GENERAL_NAMES_free(alt_names);
+ 		}
+ 
+ 		if (!result)
+ 		{
+ 			/* Common name did not match and there are no alternative names */
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" and alternatives do not match host name \"%s\"\n"),
  							  peer_cn, conn->pghost);
  		}
  	}
  

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index f950fc3..394a66f
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
***************
*** 60,68 ****
--- 60,73 ----
  #ifdef USE_SSL_ENGINE
  #include <openssl/engine.h>
  #endif
+ #include <openssl/x509v3.h>
  
  static bool verify_peer_name_matches_certificate(PGconn *);
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
+ static int	certificate_name_entry_validate_match(PGconn *conn,
+ 												  char *name,
+ 												  unsigned int len,
+ 												  bool *match);
  static void destroy_ssl_system(void);
  static int	initialize_SSL(PGconn *conn);
  static PostgresPollingStatusType open_client_SSL(PGconn *);
*************** wildcard_certificate_match(const char *p
*** 471,479 ****
  	return 1;
  }
  
  
  /*
!  *	Verify that common name resolves to peer.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
--- 476,515 ----
  	return 1;
  }
  
+ /*
+  * Validate a single certificate name entry and match it against the pghost.
+  * Returns 0 if the certificate name is invalid (contains embedded NULLs), 1 otherwise.
+  */
+ static int
+ certificate_name_entry_validate_match(PGconn *conn, char *name, unsigned int len, bool *match)
+ {
+ 	/* There is no guarantee the string returned from the certificate is NULL-terminated */
+ 	name[len] = '\0';
+ 	*match = false;
+ 	/*
+ 	 * Reject embedded NULLs in certificate common or alternative name to prevent attacks
+ 	 * like CVE-2009-4034.
+ 	 */
+ 	if (len != strlen(name))
+ 	{
+ 		printfPQExpBuffer(&conn->errorMessage,
+ 					  libpq_gettext("SSL certificate's common name contains embedded null\n"));
+ 		return 0;
+ 	}
+ 	if (pg_strcasecmp(name, conn->pghost) == 0)
+ 		/* Exact name match */
+ 		*match = true;
+ 	else if (wildcard_certificate_match(name, conn->pghost))
+ 		/* Matched wildcard certificate */
+ 		*match = true;
+ 	else
+ 		*match = false;
+ 	return 1;
+ }
+ 
  
  /*
!  *	Verify that common name or any of the alternative dNSNames resolves to peer.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
*************** verify_peer_name_matches_certificate(PGc
*** 492,499 ****
  
  	/*
  	 * Extract the common name from the certificate.
- 	 *
- 	 * XXX: Should support alternate names here
  	 */
  	/* First find out the name's length and allocate a buffer for it. */
  	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
--- 528,533 ----
*************** verify_peer_name_matches_certificate(PGc
*** 522,540 ****
  		free(peer_cn);
  		return false;
  	}
- 	peer_cn[len] = '\0';
- 
- 	/*
- 	 * Reject embedded NULLs in certificate common name to prevent attacks
- 	 * like CVE-2009-4034.
- 	 */
- 	if (len != strlen(peer_cn))
- 	{
- 		printfPQExpBuffer(&conn->errorMessage,
- 						  libpq_gettext("SSL certificate's common name contains embedded null\n"));
- 		free(peer_cn);
- 		return false;
- 	}
  
  	/*
  	 * We got the peer's common name. Now compare it against the originally
--- 556,561 ----
*************** verify_peer_name_matches_certificate(PGc
*** 546,566 ****
  						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
  		result = false;
  	}
! 	else
  	{
! 		if (pg_strcasecmp(peer_cn, conn->pghost) == 0)
! 			/* Exact name match */
! 			result = true;
! 		else if (wildcard_certificate_match(peer_cn, conn->pghost))
! 			/* Matched wildcard certificate */
! 			result = true;
! 		else
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
  							  peer_cn, conn->pghost);
- 			result = false;
  		}
  	}
  
  	free(peer_cn);
--- 567,627 ----
  						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
  		result = false;
  	}
! 	if (certificate_name_entry_validate_match(conn, peer_cn, len, &result) == 0)
  	{
! 		free(peer_cn);
! 		return false;
! 	}
! 	else if (!result)
! 	{
! 		int 				   i;
! 		int         		   san_len;
! 		STACK_OF(GENERAL_NAME) *peer_san;
! 
! 		/* Get the list and the total number of subject alternative names (SANs). */
! 		peer_san = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
! 		san_len = peer_san ? sk_GENERAL_NAME_num(peer_san) : 0;
! 
! 		/*
! 		 * Compare the alternative names dnsNames identifies against
! 		 * the originally given hostname.
! 		 */
! 		for (i = 0; i < san_len; i++)
! 		{
! 			const GENERAL_NAME *name = sk_GENERAL_NAME_value(peer_san, i);
! 			if (name->type == GEN_DNS)
! 			{
! 				int    reported_len;
! 				char  *dns_namedata,
! 					  *dns_name;
! 
! 				reported_len = ASN1_STRING_length(name->d.dNSName);
! 				/* GEN_DNS can be only IA5String, equivalent to US ASCII */
! 				dns_namedata = (char *) ASN1_STRING_data(name->d.dNSName);
! 
! 				dns_name = malloc(reported_len + 1);
! 				memcpy(dns_name, dns_namedata, reported_len);
! 				if (certificate_name_entry_validate_match(conn, dns_name, reported_len, &result) == 0)
! 				{
! 					free(peer_cn);
! 					free(dns_name);
! 					sk_GENERAL_NAMES_free(peer_san);
! 					return false;
! 				}
! 				free(dns_name);
! 			}
! 			if (result)
! 				break;
! 		}
! 		if (!result)
  		{
+ 			/* Common name did not match and there are no alternative names */
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" and alternatives do not match host name \"%s\"\n"),
  							  peer_cn, conn->pghost);
  		}
+ 		if (peer_san != NULL)
+ 			sk_GENERAL_NAMES_free(peer_san);
  	}
  
  	free(peer_cn);

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index f950fc3..a4e3fc6
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
***************
*** 60,68 ****
--- 60,73 ----
  #ifdef USE_SSL_ENGINE
  #include <openssl/engine.h>
  #endif
+ #include <openssl/x509v3.h>
  
  static bool verify_peer_name_matches_certificate(PGconn *);
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
+ static int	certificate_name_entry_validate_match(PGconn *conn,
+ 												  char *name,
+ 												  unsigned int len,
+ 												  bool *match);
  static void destroy_ssl_system(void);
  static int	initialize_SSL(PGconn *conn);
  static PostgresPollingStatusType open_client_SSL(PGconn *);
*************** wildcard_certificate_match(const char *p
*** 471,487 ****
  	return 1;
  }
  
  
  /*
!  *	Verify that common name resolves to peer.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
  {
! 	char	   *peer_cn;
! 	int			r;
! 	int			len;
! 	bool		result;
  
  	/*
  	 * If told not to verify the peer name, don't do it. Return true
--- 476,525 ----
  	return 1;
  }
  
+ /*
+  * Validate a single certificate name entry and match it against the pghost.
+  * Returns 0 if the certificate name is invalid (contains embedded NULLs), 1 otherwise.
+  */
+ static int
+ certificate_name_entry_validate_match(PGconn *conn, char *name, unsigned int len, bool *match)
+ {
+ 	/* There is no guarantee the string returned from the certificate is NULL-terminated */
+ 	name[len] = '\0';
+ 	*match = false;
+ 	/*
+ 	 * Reject embedded NULLs in certificate common or alternative name to prevent attacks
+ 	 * like CVE-2009-4034.
+ 	 */
+ 	if (len != strlen(name))
+ 	{
+ 		printfPQExpBuffer(&conn->errorMessage,
+ 					  libpq_gettext("SSL certificate's common name contains embedded null\n"));
+ 		return 0;
+ 	}
+ 	if (pg_strcasecmp(name, conn->pghost) == 0)
+ 		/* Exact name match */
+ 		*match = true;
+ 	else if (wildcard_certificate_match(name, conn->pghost))
+ 		/* Matched wildcard certificate */
+ 		*match = true;
+ 	else
+ 		*match = false;
+ 	return 1;
+ }
+ 
  
  /*
!  *	Verify that common name or any of the alternative DNS names resolves to peer.
!  *	Names in Subject Alternative Names and Common Name if present are considered.
   */
  static bool
  verify_peer_name_matches_certificate(PGconn *conn)
  {
! 	int 				   i;
! 	int         		   san_len;
! 	bool				   result;
! 	bool				   san_has_dns_names;
! 	STACK_OF(GENERAL_NAME) *peer_san;
  
  	/*
  	 * If told not to verify the peer name, don't do it. Return true
*************** verify_peer_name_matches_certificate(PGc
*** 491,569 ****
  		return true;
  
  	/*
! 	 * Extract the common name from the certificate.
! 	 *
! 	 * XXX: Should support alternate names here
  	 */
! 	/* First find out the name's length and allocate a buffer for it. */
! 	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 									NID_commonName, NULL, 0);
! 	if (len == -1)
! 	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		return false;
! 	}
! 	peer_cn = malloc(len + 1);
! 	if (peer_cn == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("out of memory\n"));
  		return false;
  	}
  
! 	r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 								  NID_commonName, peer_cn, len + 1);
! 	if (r != len)
! 	{
! 		/* Got different length than on the first call. Shouldn't happen. */
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		free(peer_cn);
! 		return false;
! 	}
! 	peer_cn[len] = '\0';
  
  	/*
! 	 * Reject embedded NULLs in certificate common name to prevent attacks
! 	 * like CVE-2009-4034.
  	 */
! 	if (len != strlen(peer_cn))
  	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("SSL certificate's common name contains embedded null\n"));
! 		free(peer_cn);
! 		return false;
! 	}
  
! 	/*
! 	 * We got the peer's common name. Now compare it against the originally
! 	 * given hostname.
! 	 */
! 	if (!(conn->pghost && conn->pghost[0] != '\0'))
! 	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
! 		result = false;
  	}
! 	else
  	{
! 		if (pg_strcasecmp(peer_cn, conn->pghost) == 0)
! 			/* Exact name match */
! 			result = true;
! 		else if (wildcard_certificate_match(peer_cn, conn->pghost))
! 			/* Matched wildcard certificate */
! 			result = true;
! 		else
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
! 							  peer_cn, conn->pghost);
! 			result = false;
  		}
! 	}
  
! 	free(peer_cn);
  	return result;
  }
  
--- 529,646 ----
  		return true;
  
  	/*
! 	 * We got the peer's common name. Now compare it against the originally
! 	 * given hostname.
  	 */
! 	if (!(conn->pghost && conn->pghost[0] != '\0'))
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
  		return false;
  	}
  
! 	/* Get the list and the total number of subject alternative names (SANs). */
! 	peer_san = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
! 	san_len = peer_san ? sk_GENERAL_NAME_num(peer_san) : 0;
! 	san_has_dns_names = false;
  
  	/*
! 	 * Compare the alternative names dnsNames identifies against
! 	 * the originally given hostname.
  	 */
! 	for (i = 0; i < san_len; i++)
  	{
! 		const GENERAL_NAME *name = sk_GENERAL_NAME_value(peer_san, i);
! 		if (name->type == GEN_DNS)
! 		{
! 			int    reported_len;
! 			char  *dns_namedata,
! 				  *dns_name;
  
! 			san_has_dns_names = true;
! 			reported_len = ASN1_STRING_length(name->d.dNSName);
! 			/* GEN_DNS can be only IA5String, equivalent to US ASCII */
! 			dns_namedata = (char *) ASN1_STRING_data(name->d.dNSName);
! 
! 			dns_name = malloc(reported_len + 1);
! 			if (dns_name == NULL)
! 			{
! 				printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("out of memory\n"));
! 				return false;
! 			}
! 			memcpy(dns_name, dns_namedata, reported_len);
! 			/* bail out immediately if an error happened during validation */
! 			if (certificate_name_entry_validate_match(conn, dns_name, reported_len, &result) == 0)
! 			{
! 				free(dns_name);
! 				sk_GENERAL_NAMES_free(peer_san);
! 				return false;
! 			}
! 			free(dns_name);
! 		}
! 		if (result)
! 			break;
  	}
! 	if (peer_san != NULL)
! 		sk_GENERAL_NAMES_free(peer_san);
! 
! 	if (!result)
  	{
! 		int			r;
! 		int			len;
! 		char	   *peer_cn;
! 
! 		/*
! 		 * Extract the common name from the certificate.
! 		 */
! 		/* First find out the name's length and allocate a buffer for it. */
! 		len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 										NID_commonName, NULL, 0);
! 		if (len == -1 && !san_has_dns_names)
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("could not get server name from server certificate\n"));
! 			return false;
  		}
! 		else if (len != -1)
! 		{
! 			peer_cn = malloc(len + 1);
! 			if (peer_cn == NULL)
! 			{
! 				printfPQExpBuffer(&conn->errorMessage,
! 								  libpq_gettext("out of memory\n"));
! 				return false;
! 			}
  
! 			r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 										  NID_commonName, peer_cn, len + 1);
! 			if (r != len && !san_has_dns_names)
! 			{
! 				/* Got different length than on the first call. Shouldn't happen. */
! 				printfPQExpBuffer(&conn->errorMessage,
! 								  libpq_gettext("could not get server name from server certificate\n"));
! 				free(peer_cn);
! 				return false;
! 			}
! 			else if (r == len)
! 			{
! 				if (certificate_name_entry_validate_match(conn, peer_cn, len, &result) == 0)
! 				{
! 					free(peer_cn);
! 					return false;
! 				}
! 			}
! 			free(peer_cn);
! 		}
! 		if (!result)
! 		{
! 			/* Common name did not match and there are no alternative names */
! 			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server names from server certficate do not match host name \"%s\"\n"),
! 							  conn->pghost);
! 		}
! 	}
  	return result;
  }
  

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index f950fc3..a4ad305
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
***************
*** 60,68 ****
--- 60,73 ----
  #ifdef USE_SSL_ENGINE
  #include <openssl/engine.h>
  #endif
+ #include <openssl/x509v3.h>
  
  static bool verify_peer_name_matches_certificate(PGconn *);
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
+ static int	certificate_name_entry_validate_match(PGconn *conn,
+ 												  ASN1_STRING *name,
+ 												  bool *match,
+ 												  char **store_name);
  static void destroy_ssl_system(void);
  static int	initialize_SSL(PGconn *conn);
  static PostgresPollingStatusType open_client_SSL(PGconn *);
*************** wildcard_certificate_match(const char *p
*** 473,540 ****
  
  
  /*
!  *	Verify that common name resolves to peer.
   */
! static bool
! verify_peer_name_matches_certificate(PGconn *conn)
  {
! 	char	   *peer_cn;
! 	int			r;
! 	int			len;
! 	bool		result;
! 
! 	/*
! 	 * If told not to verify the peer name, don't do it. Return true
! 	 * indicating that the verification was successful.
! 	 */
! 	if (strcmp(conn->sslmode, "verify-full") != 0)
! 		return true;
  
! 	/*
! 	 * Extract the common name from the certificate.
! 	 *
! 	 * XXX: Should support alternate names here
! 	 */
! 	/* First find out the name's length and allocate a buffer for it. */
! 	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 									NID_commonName, NULL, 0);
! 	if (len == -1)
! 	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		return false;
! 	}
! 	peer_cn = malloc(len + 1);
! 	if (peer_cn == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("out of memory\n"));
! 		return false;
  	}
  
! 	r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 								  NID_commonName, peer_cn, len + 1);
! 	if (r != len)
  	{
- 		/* Got different length than on the first call. Shouldn't happen. */
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		free(peer_cn);
! 		return false;
  	}
! 	peer_cn[len] = '\0';
  
  	/*
! 	 * Reject embedded NULLs in certificate common name to prevent attacks
  	 * like CVE-2009-4034.
  	 */
! 	if (len != strlen(peer_cn))
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("SSL certificate's common name contains embedded null\n"));
! 		free(peer_cn);
! 		return false;
  	}
  
  	/*
  	 * We got the peer's common name. Now compare it against the originally
--- 478,573 ----
  
  
  /*
!  * Extract the name from the certificate name entry and match it against the pghost.
!  * Returns 0 if the certificate name is invalid (contains embedded NULLs), 1 otherwise.
   */
! static int
! certificate_name_entry_validate_match(PGconn *conn, ASN1_STRING *name_entry,
! 									  bool *match, char **store_name)
  {
! 	int 	len;
! 	char 	*name,
! 			*namedata;
  
! 	/* Should not happen... */
! 	if (name_entry == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						libpq_gettext("SSL certificate's name entry is missing"));
! 		return 0;
  	}
  
! 	/* GEN_DNS can be only IA5String, equivalent to US ASCII */
! 	namedata = (char *) ASN1_STRING_data(name_entry);
! 	len = ASN1_STRING_length(name_entry);
! 	name = malloc(len + 1);
! 	if (name == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 					  libpq_gettext("out of memory\n"));
! 		return 0;
  	}
! 	memcpy(name, namedata, len);
! 	/* There is no guarantee the string returned from the certificate is NULL-terminated */
! 	name[len] = '\0';
  
  	/*
! 	 * Reject embedded NULLs in certificate common or alternative name to prevent attacks
  	 * like CVE-2009-4034.
  	 */
! 	if (len != strlen(name))
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 					  libpq_gettext("SSL certificate's name contains embedded null\n"));
! 		free(name);
! 		return 0;
  	}
+ 	if (pg_strcasecmp(name, conn->pghost) == 0)
+ 		/* Exact name match */
+ 		*match = true;
+ 	else if (wildcard_certificate_match(name, conn->pghost))
+ 		/* Matched wildcard certificate */
+ 		*match = true;
+ 	else
+ 	{
+ 		*match = false;
+ 		/* store the non-matching certificate name for further reporting */
+ 		if (*store_name == NULL)
+ 		{
+ 			*store_name = malloc(len + 1);
+ 			if (*store_name == NULL)
+ 			{
+ 				printfPQExpBuffer(&conn->errorMessage,
+ 					  		libpq_gettext("out of memory\n"));
+ 				return 0;
+ 			}
+ 			memcpy(*store_name, name, len + 1);
+ 		}
+ 	}
+ 	free(name);
+ 	return 1;
+ }
+ 
+ /*
+  *	Verify that common name or any of the alternative DNS names resolves to peer.
+  *	Names in Subject Alternative Names and Common Name if present are considered.
+  */
+ static bool
+ verify_peer_name_matches_certificate(PGconn *conn)
+ {
+ 	int 				   i;
+ 	int         		   san_len;
+ 	int 				   names_examined;
+ 	bool				   result;
+ 	STACK_OF(GENERAL_NAME) *peer_san;
+ 	char 				   *reported_name = NULL;
+ 
+ 	/*
+ 	 * If told not to verify the peer name, don't do it. Return true
+ 	 * indicating that the verification was successful.
+ 	 */
+ 	if (strcmp(conn->sslmode, "verify-full") != 0)
+ 		return true;
  
  	/*
  	 * We got the peer's common name. Now compare it against the originally
*************** verify_peer_name_matches_certificate(PGc
*** 544,569 ****
  	{
  		printfPQExpBuffer(&conn->errorMessage,
  						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
! 		result = false;
  	}
! 	else
  	{
! 		if (pg_strcasecmp(peer_cn, conn->pghost) == 0)
! 			/* Exact name match */
! 			result = true;
! 		else if (wildcard_certificate_match(peer_cn, conn->pghost))
! 			/* Matched wildcard certificate */
! 			result = true;
! 		else
  		{
! 			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
! 							  peer_cn, conn->pghost);
! 			result = false;
  		}
  	}
  
! 	free(peer_cn);
  	return result;
  }
  
--- 577,671 ----
  	{
  		printfPQExpBuffer(&conn->errorMessage,
  						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
! 		return false;
  	}
! 
! 	/* Get the list and the total number of subject alternative names (SANs). */
! 	peer_san = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
! 	san_len = peer_san ? sk_GENERAL_NAME_num(peer_san) : 0;
! 	names_examined = 0;
! 
! 	/*
! 	 * Compare the alternative names dnsNames identifies against
! 	 * the originally given hostname.
! 	 */
! 	for (i = 0; i < san_len; i++)
  	{
! 		const GENERAL_NAME *name = sk_GENERAL_NAME_value(peer_san, i);
! 		if (name->type == GEN_DNS)
  		{
! 			names_examined++;
! 
! 			/* bail out immediately if an error happened during validation */
! 			if (certificate_name_entry_validate_match(conn, name->d.dNSName, &result, &reported_name) == 0)
! 			{
! 				sk_GENERAL_NAMES_free(peer_san);
! 				free(reported_name);
! 				return false;
! 			}
  		}
+ 		if (result)
+ 			break;
  	}
+ 	if (peer_san != NULL)
+ 		sk_GENERAL_NAMES_free(peer_san);
  
! 	if (!result)
! 	{
! 		X509_NAME  *subject_name;
! 
! 		/*
! 		 * Extract the common name from the certificate.
! 		 */
! 		subject_name = X509_get_subject_name(conn->peer);
! 		if (subject_name == NULL && names_examined == 0)
! 		{
! 			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("could not get server name from server SSL certificate\n"));
! 			free(reported_name);
! 			return false;
! 		}
! 		else if (subject_name != NULL)
! 		{
! 			/* First find out the name's length and allocate a buffer for it. */
! 			int cn_index = X509_NAME_get_index_by_NID(subject_name,
! 		 								   	  	NID_commonName, -1);
! 
! 			if (cn_index < 0 && names_examined == 0)
! 			{
! 				printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("could not get server name from server SSL certificate\n"));
! 				free(reported_name);
! 				return false;
! 			}
! 			else if (cn_index >= 0)
! 			{
! 				/* The name for the potential error report will be copied from the common name */
! 				free(reported_name);
! 				reported_name = NULL;
! 				names_examined++;
! 				if (certificate_name_entry_validate_match(conn,
! 												  X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, cn_index)),
! 												  &result, &reported_name) == 0)
! 				return false;
! 			}
! 		}
! 
! 		if (!result)
! 		{
! 			/* Common name did not match and there are no alternative names */
! 			if (names_examined > 1)
! 				printfPQExpBuffer(&conn->errorMessage,
! 							  	  libpq_gettext("server name \"%s\" and %d other names from server SSL certificate do not match host name \"%s\"\n"),
! 							  	  reported_name, names_examined - 1, conn->pghost);
! 			else
! 				printfPQExpBuffer(&conn->errorMessage,
! 							  	  libpq_gettext("server name \"%s\" from server SSL certificate does not match host name \"%s\"\n"),
! 							  	  reported_name, conn->pghost);
! 
! 		}
! 	}
! 	free(reported_name);
  	return result;
  }
  

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index f950fc3..4f6f324 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -60,9 +60,13 @@
 #ifdef USE_SSL_ENGINE
 #include <openssl/engine.h>
 #endif
+#include <openssl/x509v3.h>
 
 static bool verify_peer_name_matches_certificate(PGconn *);
 static int	verify_cb(int ok, X509_STORE_CTX *ctx);
+static int	verify_peer_name_matches_certificate_name(PGconn *conn,
+												  ASN1_STRING *name,
+												  char **store_name);
 static void destroy_ssl_system(void);
 static int	initialize_SSL(PGconn *conn);
 static PostgresPollingStatusType open_client_SSL(PGconn *);
@@ -473,98 +477,229 @@ wildcard_certificate_match(const char *pattern, const char *string)
 
 
 /*
- *	Verify that common name resolves to peer.
+ * Check if a name from a server's certificate matches the peer's hostname.
+ *
+ * Returns 1 if the name matches, and 0 if it does not. On error, returns
+ * -1, and sets the libpq error message.
+ *
+ * The name extracted from the certificate is returned in *store_name. The
+ * caller is responsible for freeing it.
  */
-static bool
-verify_peer_name_matches_certificate(PGconn *conn)
+static int
+verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry,
+										  char **store_name)
 {
-	char	   *peer_cn;
-	int			r;
 	int			len;
-	bool		result;
+	char	   *name;
+	unsigned char *namedata;
+	int			result;
 
-	/*
-	 * If told not to verify the peer name, don't do it. Return true
-	 * indicating that the verification was successful.
-	 */
-	if (strcmp(conn->sslmode, "verify-full") != 0)
-		return true;
+	*store_name = NULL;
+
+	/* Should not happen... */
+	if (name_entry == NULL)
+	{
+		printfPQExpBuffer(&conn->errorMessage,
+				  libpq_gettext("SSL certificate's name entry is missing\n"));
+		return -1;
+	}
 
 	/*
-	 * Extract the common name from the certificate.
+	 * GEN_DNS can be only IA5String, equivalent to US ASCII.
 	 *
-	 * XXX: Should support alternate names here
+	 * There is no guarantee the string returned from the certificate is
+	 * NULL-terminated, so make a copy that is.
 	 */
-	/* First find out the name's length and allocate a buffer for it. */
-	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
-									NID_commonName, NULL, 0);
-	if (len == -1)
+	namedata = ASN1_STRING_data(name_entry);
+	len = ASN1_STRING_length(name_entry);
+	name = malloc(len + 1);
+	if (name == NULL)
 	{
 		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("could not get server common name from server certificate\n"));
-		return false;
+						  libpq_gettext("out of memory\n"));
+		return -1;
 	}
-	peer_cn = malloc(len + 1);
-	if (peer_cn == NULL)
+	memcpy(name, namedata, len);
+	name[len] = '\0';
+
+	/*
+	 * Reject embedded NULLs in certificate common or alternative name to
+	 * prevent attacks like CVE-2009-4034.
+	 */
+	if (len != strlen(name))
 	{
+		free(name);
 		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("out of memory\n"));
-		return false;
+			libpq_gettext("SSL certificate's name contains embedded null\n"));
+		return -1;
 	}
 
-	r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
-								  NID_commonName, peer_cn, len + 1);
-	if (r != len)
+	if (pg_strcasecmp(name, conn->pghost) == 0)
 	{
-		/* Got different length than on the first call. Shouldn't happen. */
-		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("could not get server common name from server certificate\n"));
-		free(peer_cn);
-		return false;
+		/* Exact name match */
+		result = 1;
 	}
-	peer_cn[len] = '\0';
+	else if (wildcard_certificate_match(name, conn->pghost))
+	{
+		/* Matched wildcard certificate */
+		result = 1;
+	}
+	else
+	{
+		result = 0;
+	}
+
+	*store_name = name;
+	return result;
+}
+
+/*
+ *	Verify that the server certificate matches the hostname we connected to.
+ *
+ * The certificate's Common Name and Subject Alternative Names are considered.
+ */
+static bool
+verify_peer_name_matches_certificate(PGconn *conn)
+{
+	int			names_examined = 0;
+	bool		found_match = false;
+	bool		got_error = false;
+	char	   *first_name = NULL;
+	STACK_OF(GENERAL_NAME) *peer_san;
+	int 		i;
+	int			rc;
 
 	/*
-	 * Reject embedded NULLs in certificate common name to prevent attacks
-	 * like CVE-2009-4034.
+	 * If told not to verify the peer name, don't do it. Return true
+	 * indicating that the verification was successful.
 	 */
-	if (len != strlen(peer_cn))
+	if (strcmp(conn->sslmode, "verify-full") != 0)
+		return true;
+
+	/* Check that we have a hostname to compare with. */
+	if (!(conn->pghost && conn->pghost[0] != '\0'))
 	{
 		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("SSL certificate's common name contains embedded null\n"));
-		free(peer_cn);
+						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
 		return false;
 	}
 
 	/*
-	 * We got the peer's common name. Now compare it against the originally
-	 * given hostname.
+	 * First, get the Subject Alternative Names (SANs) from the certificate,
+	 * and compare them against the originally given hostname.
 	 */
-	if (!(conn->pghost && conn->pghost[0] != '\0'))
+	peer_san = (STACK_OF(GENERAL_NAME) *)
+		X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
+
+	if (peer_san)
 	{
-		printfPQExpBuffer(&conn->errorMessage,
-						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
-		result = false;
+		int			san_len = sk_GENERAL_NAME_num(peer_san);
+
+		for (i = 0; i < san_len && !found_match && !got_error; i++)
+		{
+			const GENERAL_NAME *name = sk_GENERAL_NAME_value(peer_san, i);
+
+			if (name->type == GEN_DNS)
+			{
+				char *alt_name;
+
+				names_examined++;
+				rc = verify_peer_name_matches_certificate_name(conn,
+															   name->d.dNSName,
+															   &alt_name);
+				if (rc == -1)
+					got_error = true;
+				if (rc == 1)
+					found_match = true;
+
+				if (alt_name)
+				{
+					if (!first_name)
+						first_name = alt_name;
+					else
+						free(alt_name);
+				}
+			}
+		}
+		sk_GENERAL_NAME_free(peer_san);
 	}
-	else
+
+	/*
+	 * If no match to any of the SANs, check the Common Name.
+	 */
+	if (!found_match && !got_error)
 	{
-		if (pg_strcasecmp(peer_cn, conn->pghost) == 0)
-			/* Exact name match */
-			result = true;
-		else if (wildcard_certificate_match(peer_cn, conn->pghost))
-			/* Matched wildcard certificate */
-			result = true;
+		X509_NAME  *subject_name;
+
+		subject_name = X509_get_subject_name(conn->peer);
+
+		if (subject_name != NULL)
+		{
+			int			cn_index;
+
+			cn_index = X509_NAME_get_index_by_NID(subject_name,
+												  NID_commonName, -1);
+			if (cn_index >= 0)
+			{
+				/*
+				 * We prefer the Common Name over SANs in the error message,
+				 * if both are present.
+				 */
+				if (first_name)
+					free(first_name);
+
+				names_examined++;
+				rc = verify_peer_name_matches_certificate_name(
+					conn,
+					X509_NAME_ENTRY_get_data(
+						X509_NAME_get_entry(subject_name, cn_index)),
+					&first_name);
+
+				if (rc == -1)
+					got_error = true;
+				else if (rc == 1)
+					found_match = true;
+			}
+		}
+	}
+
+	if (!found_match && !got_error)
+	{
+		/*
+		 * No match. Include the host name from the server certificate in the
+		 * error message, to aid debugging broken configurations. If there
+		 * are multiple names, only print the first one to avoid an overly
+		 * long error message.
+		 */
+		if (names_examined > 1)
+		{
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("server certificate for \"%s\" (and %d other names) does not match host name \"%s\"\n"),
+							  first_name, names_examined - 1, conn->pghost);
+		}
+		else if (names_examined == 1)
+		{
+			printfPQExpBuffer(&conn->errorMessage,
+							  libpq_gettext("server certificate for \"%s\" does not match host name \"%s\"\n"),
+							  first_name, conn->pghost);
+		}
 		else
 		{
 			printfPQExpBuffer(&conn->errorMessage,
-							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
-							  peer_cn, conn->pghost);
-			result = false;
+							  libpq_gettext("could not get server's hostname from server certificate\n"));
 		}
 	}
 
-	free(peer_cn);
-	return result;
+	/* clean up */
+	if (first_name)
+		free(first_name);
+
+	if (found_match)
+		return 1;
+	else if (got_error)
+		return -1;
+	else
+		return 0;
 }
 
 #ifdef ENABLE_THREAD_SAFETY

diff --git a/src/interfaces/libpq/fe-misc.c b/src/interfaces/libpq/fe-misc.c
new file mode 100644
index fc930bd..a082268
*** a/src/interfaces/libpq/fe-misc.c
--- b/src/interfaces/libpq/fe-misc.c
*************** static int	pqSendSome(PGconn *conn, int 
*** 64,69 ****
--- 64,71 ----
  static int pqSocketCheck(PGconn *conn, int forRead, int forWrite,
  			  time_t end_time);
  static int	pqSocketPoll(int sock, int forRead, int forWrite, time_t end_time);
+ static void libpq_bindomain();
+ 
  
  /*
   * PQlibVersion: return the libpq version number
*************** PQenv2encoding(void)
*** 1210,1223 ****
  
  #ifdef ENABLE_NLS
  
! char *
! libpq_gettext(const char *msgid)
  {
  	static bool already_bound = false;
  
  	if (!already_bound)
  	{
! 		/* dgettext() preserves errno, but bindtextdomain() doesn't */
  #ifdef WIN32
  		int			save_errno = GetLastError();
  #else
--- 1212,1225 ----
  
  #ifdef ENABLE_NLS
  
! static void
! libpq_bindomain()
  {
  	static bool already_bound = false;
  
  	if (!already_bound)
  	{
! 		/* bindtextdomain() does not preserve errno */
  #ifdef WIN32
  		int			save_errno = GetLastError();
  #else
*************** libpq_gettext(const char *msgid)
*** 1237,1244 ****
--- 1239,1258 ----
  		errno = save_errno;
  #endif
  	}
+ }
  
+ char *
+ libpq_gettext(const char *msgid)
+ {
+ 	libpq_bindomain();
  	return dgettext(PG_TEXTDOMAIN("libpq"), msgid);
  }
  
+ char *
+ libpq_ngettext(const char *msgid, const char *msgid_plural, unsigned long n)
+ {
+ 	libpq_bindomain();
+ 	return dngettext(PG_TEXTDOMAIN("libpq"), msgid, msgid_plural, n);
+ }
+ 
  #endif   /* ENABLE_NLS */
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index f950fc3..c51e8ff
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
***************
*** 60,68 ****
--- 60,72 ----
  #ifdef USE_SSL_ENGINE
  #include <openssl/engine.h>
  #endif
+ #include <openssl/x509v3.h>
  
  static bool verify_peer_name_matches_certificate(PGconn *);
  static int	verify_cb(int ok, X509_STORE_CTX *ctx);
+ static int	verify_peer_name_matches_certificate_name(PGconn *conn,
+ 												  ASN1_STRING *name,
+ 												  char **store_name);
  static void destroy_ssl_system(void);
  static int	initialize_SSL(PGconn *conn);
  static PostgresPollingStatusType open_client_SSL(PGconn *);
*************** wildcard_certificate_match(const char *p
*** 473,570 ****
  
  
  /*
!  *	Verify that common name resolves to peer.
   */
! static bool
! verify_peer_name_matches_certificate(PGconn *conn)
  {
- 	char	   *peer_cn;
- 	int			r;
  	int			len;
! 	bool		result;
  
! 	/*
! 	 * If told not to verify the peer name, don't do it. Return true
! 	 * indicating that the verification was successful.
! 	 */
! 	if (strcmp(conn->sslmode, "verify-full") != 0)
! 		return true;
  
  	/*
! 	 * Extract the common name from the certificate.
  	 *
! 	 * XXX: Should support alternate names here
  	 */
! 	/* First find out the name's length and allocate a buffer for it. */
! 	len = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 									NID_commonName, NULL, 0);
! 	if (len == -1)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		return false;
  	}
! 	peer_cn = malloc(len + 1);
! 	if (peer_cn == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("out of memory\n"));
! 		return false;
  	}
  
! 	r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
! 								  NID_commonName, peer_cn, len + 1);
! 	if (r != len)
  	{
! 		/* Got different length than on the first call. Shouldn't happen. */
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("could not get server common name from server certificate\n"));
! 		free(peer_cn);
! 		return false;
  	}
! 	peer_cn[len] = '\0';
  
  	/*
! 	 * Reject embedded NULLs in certificate common name to prevent attacks
! 	 * like CVE-2009-4034.
  	 */
! 	if (len != strlen(peer_cn))
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("SSL certificate's common name contains embedded null\n"));
! 		free(peer_cn);
  		return false;
  	}
  
  	/*
! 	 * We got the peer's common name. Now compare it against the originally
! 	 * given hostname.
  	 */
! 	if (!(conn->pghost && conn->pghost[0] != '\0'))
  	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
! 		result = false;
  	}
! 	else
  	{
! 		if (pg_strcasecmp(peer_cn, conn->pghost) == 0)
! 			/* Exact name match */
! 			result = true;
! 		else if (wildcard_certificate_match(peer_cn, conn->pghost))
! 			/* Matched wildcard certificate */
! 			result = true;
  		else
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"),
! 							  peer_cn, conn->pghost);
! 			result = false;
  		}
  	}
  
! 	free(peer_cn);
! 	return result;
  }
  
  #ifdef ENABLE_THREAD_SAFETY
--- 477,704 ----
  
  
  /*
!  * Check if a name from a server's certificate matches the peer's hostname.
!  *
!  * Returns 1 if the name matches, and 0 if it does not. On error, returns
!  * -1, and sets the libpq error message.
!  *
!  * The name extracted from the certificate is returned in *store_name. The
!  * caller is responsible for freeing it.
   */
! static int
! verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry,
! 										  char **store_name)
  {
  	int			len;
! 	char	   *name;
! 	unsigned char *namedata;
! 	int			result;
  
! 	*store_name = NULL;
! 
! 	/* Should not happen... */
! 	if (name_entry == NULL)
! 	{
! 		printfPQExpBuffer(&conn->errorMessage,
! 				  libpq_gettext("SSL certificate's name entry is missing\n"));
! 		return -1;
! 	}
  
  	/*
! 	 * GEN_DNS can be only IA5String, equivalent to US ASCII.
  	 *
! 	 * There is no guarantee the string returned from the certificate is
! 	 * NULL-terminated, so make a copy that is.
  	 */
! 	namedata = ASN1_STRING_data(name_entry);
! 	len = ASN1_STRING_length(name_entry);
! 	name = malloc(len + 1);
! 	if (name == NULL)
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("out of memory\n"));
! 		return -1;
  	}
! 	memcpy(name, namedata, len);
! 	name[len] = '\0';
! 
! 	/*
! 	 * Reject embedded NULLs in certificate common or alternative name to
! 	 * prevent attacks like CVE-2009-4034.
! 	 */
! 	if (len != strlen(name))
  	{
+ 		free(name);
  		printfPQExpBuffer(&conn->errorMessage,
! 			libpq_gettext("SSL certificate's name contains embedded null\n"));
! 		return -1;
  	}
  
! 	if (pg_strcasecmp(name, conn->pghost) == 0)
  	{
! 		/* Exact name match */
! 		result = 1;
! 	}
! 	else if (wildcard_certificate_match(name, conn->pghost))
! 	{
! 		/* Matched wildcard certificate */
! 		result = 1;
! 	}
! 	else
! 	{
! 		result = 0;
  	}
! 
! 	*store_name = name;
! 	return result;
! }
! 
! /*
!  *	Verify that the server certificate matches the hostname we connected to.
!  *
!  * The certificate's Common Name and Subject Alternative Names are considered.
!  */
! static bool
! verify_peer_name_matches_certificate(PGconn *conn)
! {
! 	int			names_examined = 0;
! 	bool		found_match = false;
! 	bool		got_error = false;
! 	char	   *first_name = NULL;
! 	STACK_OF(GENERAL_NAME) *peer_san;
! 	int 		i;
! 	int			rc;
  
  	/*
! 	 * If told not to verify the peer name, don't do it. Return true
! 	 * indicating that the verification was successful.
  	 */
! 	if (strcmp(conn->sslmode, "verify-full") != 0)
! 		return true;
! 
! 	/* Check that we have a hostname to compare with. */
! 	if (!(conn->pghost && conn->pghost[0] != '\0'))
  	{
  		printfPQExpBuffer(&conn->errorMessage,
! 						  libpq_gettext("host name must be specified for a verified SSL connection\n"));
  		return false;
  	}
  
  	/*
! 	 * First, get the Subject Alternative Names (SANs) from the certificate,
! 	 * and compare them against the originally given hostname.
  	 */
! 	peer_san = (STACK_OF(GENERAL_NAME) *)
! 		X509_get_ext_d2i(conn->peer, NID_subject_alt_name, NULL, NULL);
! 
! 	if (peer_san)
  	{
! 		int			san_len = sk_GENERAL_NAME_num(peer_san);
! 
! 		for (i = 0; i < san_len; i++)
! 		{
! 			const GENERAL_NAME *name = sk_GENERAL_NAME_value(peer_san, i);
! 
! 			if (name->type == GEN_DNS)
! 			{
! 				char *alt_name;
! 
! 				names_examined++;
! 				rc = verify_peer_name_matches_certificate_name(conn,
! 															   name->d.dNSName,
! 															   &alt_name);
! 				if (rc == -1)
! 					got_error = true;
! 				if (rc == 1)
! 					found_match = true;
! 
! 				if (alt_name)
! 				{
! 					if (!first_name)
! 						first_name = alt_name;
! 					else
! 						free(alt_name);
! 				}
! 			}
! 			if (found_match || got_error)
! 				break;
! 		}
! 		sk_GENERAL_NAME_free(peer_san);
  	}
! 
! 	/*
! 	 * If no match to any of the SANs, check the Common Name.
! 	 */
! 	if (!found_match && !got_error)
  	{
! 		X509_NAME  *subject_name;
! 
! 		subject_name = X509_get_subject_name(conn->peer);
! 
! 		if (subject_name != NULL)
! 		{
! 			int			cn_index;
! 
! 			cn_index = X509_NAME_get_index_by_NID(subject_name,
! 												  NID_commonName, -1);
! 			if (cn_index >= 0)
! 			{
! 				/*
! 				 * We prefer the Common Name over SANs in the error message,
! 				 * if both are present.
! 				 */
! 				if (first_name)
! 					free(first_name);
! 
! 				names_examined++;
! 				rc = verify_peer_name_matches_certificate_name(
! 					conn,
! 					X509_NAME_ENTRY_get_data(
! 						X509_NAME_get_entry(subject_name, cn_index)),
! 					&first_name);
! 
! 				if (rc == -1)
! 					got_error = true;
! 				else if (rc == 1)
! 					found_match = true;
! 			}
! 		}
! 	}
! 
! 	if (!found_match && !got_error)
! 	{
! 		/*
! 		 * No match. Include the host name from the server certificate in the
! 		 * error message, to aid debugging broken configurations. If there
! 		 * are multiple names, only print the first one to avoid an overly
! 		 * long error message.
! 		 */
! 		if (names_examined > 1)
! 		{
! 			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_ngettext("server certificate for \"%s\" (and %d other name) does not match host name \"%s\"\n",
! 							  				 "server certificate for \"%s\" (and %d other names) does not match host name \"%s\"\n",
! 							  				 names_examined - 1),
! 							  first_name, names_examined - 1, conn->pghost);
! 		}
! 		else if (names_examined == 1)
! 		{
! 			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("server certificate for \"%s\" does not match host name \"%s\"\n"),
! 							  first_name, conn->pghost);
! 		}
  		else
  		{
  			printfPQExpBuffer(&conn->errorMessage,
! 							  libpq_gettext("could not get server's hostname from server certificate\n"));
  		}
  	}
  
! 	/* clean up */
! 	if (first_name)
! 		free(first_name);
! 
! 	return found_match && !got_error;
  }
  
  #ifdef ENABLE_THREAD_SAFETY
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
new file mode 100644
index 6032904..9808ab4
*** a/src/interfaces/libpq/libpq-int.h
--- b/src/interfaces/libpq/libpq-int.h
*************** extern ssize_t pgtls_write(PGconn *conn,
*** 653,660 ****
--- 653,664 ----
  extern char *
  libpq_gettext(const char *msgid)
  __attribute__((format_arg(1)));
+ extern char *
+ libpq_ngettext(const char *msgid, const char *msgid_plural, unsigned long n)
+ __attribute__((format_arg(1))) __attribute__((format_arg(2)));
  #else
  #define libpq_gettext(x) (x)
+ #define libpq_ngettext(s,p,n) ((n) == 1 ? (s) : (p))
  #endif
  
  /*

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
new file mode 100644
index 98d02b6..dd4fab8
*** a/src/interfaces/libpq/fe-secure-openssl.c
--- b/src/interfaces/libpq/fe-secure-openssl.c
*************** verify_peer_name_matches_certificate(PGc
*** 626,637 ****
  		sk_GENERAL_NAME_free(peer_san);
  	}
  	/*
! 	 * If there is no subjectAltName extension, check the Common Name.
  	 *
! 	 * (Per RFC 2818 and RFC 6125, if the subjectAltName extension is present,
  	 * the CN must be ignored.)
  	 */
! 	else
  	{
  		X509_NAME  *subject_name;
  
--- 626,637 ----
  		sk_GENERAL_NAME_free(peer_san);
  	}
  	/*
! 	 * If there is no subjectAltName extension of type dNSName, check the Common Name.
  	 *
! 	 * (Per RFC 2818 and RFC 6125, if the subjectAltName extension of type dNSName is present,
  	 * the CN must be ignored.)
  	 */
! 	if (names_examined == 0)
  	{
  		X509_NAME  *subject_name;