--- ../src/curl/lib/ssluse.c	Fri Jan 16 09:04:19 2004
+++ ssluse2.c	Fri Jan 16 09:04:09 2004
@@ -780,7 +780,6 @@
 static CURLcode verifyhost(struct connectdata *conn,
                            X509 *server_cert)
 {
-  char peer_CN[257];
   bool matched = FALSE; /* no alternative match yet */
   int target = GEN_DNS; /* target type, GEN_DNS or GEN_IPADD */
   int addrlen;
@@ -867,11 +866,35 @@
     /* an alternative name matched the server hostname */
     infof(data, "\t subjectAltName: %s matched\n", conn->hostname);
   else {
-    bool obtain=FALSE;
-    if(X509_NAME_get_text_by_NID(X509_get_subject_name(server_cert),
-                                 NID_commonName,
-                                 peer_CN,
-                                 sizeof(peer_CN)) < 0) {
+    /* we have to look to the last occurence of a commonName in the
+       distinguished one to get the most significant one. */
+    int j,i=-1 ;
+    unsigned char * peer_CN=NULL;
+
+    X509_NAME *name = X509_get_subject_name(server_cert) ;   
+    if (name) 
+      while ((j=X509_NAME_get_index_by_NID(name,NID_commonName,i))>=0) 
+        i=j; 
+
+    /* we have the name entry and we will now convert this to a string
+       that we can use for comparison. Doing this we support BMPstring,
+       UTF8 etc. */
+    if (i>=0)
+      j = ASN1_STRING_to_UTF8(&peer_CN,X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name,i))) ;
+
+    /* add one zero octet, maybe this is already done by OpenSSL ?? */
+    if (peer_CN) {
+      char * pCN2 = OPENSSL_realloc(peer_CN,j+1);
+      if (!pCN2) {
+        OPENSSL_free(peer_CN);
+        peer_CN = NULL;
+      } else {
+        peer_CN = pCN2;
+        peer_CN[j] = '\0';
+      }
+    } 
+    
+    if (!peer_CN) {
       if(data->set.ssl.verifyhost > 1) {
         failf(data,
               "SSL: unable to obtain common name from peer certificate");
@@ -882,26 +905,23 @@
            output a note about the situation */
         infof(data, "\t common name: WARNING couldn't obtain\n");
       }
-    }
-    else
-      obtain = TRUE;
-         
-    if(obtain) {
-      if(!cert_hostcheck(peer_CN, conn->hostname)) {
-        if(data->set.ssl.verifyhost > 1) {
-          failf(data, "SSL: certificate subject name '%s' does not match "
-                "target host name '%s'", peer_CN, conn->hostname);
-          return CURLE_SSL_PEER_CERTIFICATE;
-        }
-        else
-          infof(data, "\t common name: %s (does not match '%s')\n",
-                peer_CN, conn->hostname);
+    } else if(!cert_hostcheck(peer_CN, conn->hostname)) {
+      if(data->set.ssl.verifyhost > 1) {
+        failf(data, "SSL: certificate subject name '%s' does not match "
+              "target host name '%s'", peer_CN, conn->hostname);
+        OPENSSL_free(peer_CN);
+        return CURLE_SSL_PEER_CERTIFICATE ;
       }
       else
-        infof(data, "\t common name: %s (matched)\n", peer_CN);
+        infof(data, "\t common name: %s (does not match '%s')\n",
+              peer_CN, conn->hostname);
+    }
+    else {
+      infof(data, "\t common name: %s (matched)\n", peer_CN);
+      OPENSSL_free(peer_CN);
     }
   }
-
+ 
   return CURLE_OK;
 }
 #endif