--- curl-7.19.6/lib/ssluse.c.orig	2009-09-15 11:10:48.000000000 +0200
+++ curl-7.19.6/lib/ssluse.c	2009-09-15 11:41:10.000000000 +0200
@@ -1057,6 +1057,7 @@ static CURLcode verifyhost(struct connec
                            X509 *server_cert)
 {
   bool matched = FALSE; /* no alternative match yet */
+  bool dnsipaltname = FALSE; /* did we found an DNS or IP altname? */
   int target = GEN_DNS; /* target type, GEN_DNS or GEN_IPADD */
   size_t addrlen = 0;
   struct SessionHandle *data = conn->data;
@@ -1105,6 +1106,7 @@ static CURLcode verifyhost(struct connec
 
         switch(target) {
         case GEN_DNS: /* name/pattern comparison */
+	  dnsipaltname = TRUE;
           /* The OpenSSL man page explicitly says: "In general it cannot be
              assumed that the data returned by ASN1_STRING_data() is null
              terminated or does not contain embedded nulls." But also that
@@ -1123,6 +1125,7 @@ static CURLcode verifyhost(struct connec
           break;
 
         case GEN_IPADD: /* IP address comparison */
+	  dnsipaltname = TRUE;
           /* compare alternative IP address if the data chunk is the same size
              our server IP address is */
           if((altlen == addrlen) && !memcmp(altptr, &addr, altlen))
@@ -1137,8 +1140,8 @@ static CURLcode verifyhost(struct connec
   if(matched)
     /* an alternative name matched the server hostname */
     infof(data, "\t subjectAltName: %s matched\n", conn->host.dispname);
-  else if(altnames) {
-    /* an alternative name field existed, but didn't match and then
+  else if(dnsipaltname) {
+    /* an alternative name DNS or IP field existed, but didn't match and then
        we MUST fail */
     infof(data, "\t subjectAltName does not match %s\n", conn->host.dispname);
     res = CURLE_PEER_FAILED_VERIFICATION;