Let's support multiple names for certificate verification

This adds the functionality to VERIFY_PARAM to separately add multiple
ip's and email addresses for verification purposes.

We then mark the unfortunate SSL_add1_host API which unfortunately
aquired a confusing "maybe add an IP address" behaviour as deprecated.

We replace this with SSL_set1_<dnsname, email, ip, ip_asc> and
SSL_add1_<dnsname, email, ip, ip_asc> to set the things in the SSL
corresponding to the VERIFY_PARAM funcitons.

Fixes: https://github.com/openssl/openssl/issues/28418

Reviewed-by: Neil Horman <[email protected]>
Reviewed-by: Viktor Dukhovni <[email protected]>
MergeDate: Tue Feb 24 14:03:42 2026
(Merged from https://github.com/openssl/openssl/pull/29612)

8 files changed, 8 insertions, 8 deletions

diff --git a/demos/bio/sconnect.c b/demos/bio/sconnect.c
index e069209e726..a3b3eabfc86 100644
--- a/demos/bio/sconnect.c
+++ b/demos/bio/sconnect.c
@@ -81,7 +81,7 @@ int main(int argc, char *argv[])
 
     /* The BIO has parsed the host:port and even IPv6 literals in [] */
     hostname = BIO_get_conn_hostname(out);
-    if (!hostname || SSL_set1_host(ssl, hostname) <= 0) {
+    if (!hostname || SSL_set1_dnsname(ssl, hostname) <= 0) {
         BIO_free(ssl_bio);
         goto err;
     }
diff --git a/demos/guide/quic-client-block.c b/demos/guide/quic-client-block.c
index 80eccbab847..a2208f5e11d 100644
--- a/demos/guide/quic-client-block.c
+++ b/demos/guide/quic-client-block.c
@@ -204,7 +204,7 @@ int main(int argc, char *argv[])
      * Virtually all clients should do this unless you really know what you
      * are doing.
      */
-    if (!SSL_set1_host(ssl, hostname)) {
+    if (!SSL_set1_dnsname(ssl, hostname)) {
         printf("Failed to set the certificate verification hostname");
         goto end;
     }
diff --git a/demos/guide/quic-client-non-block.c b/demos/guide/quic-client-non-block.c
index 9e8760dde24..a38fdf411e0 100644
--- a/demos/guide/quic-client-non-block.c
+++ b/demos/guide/quic-client-non-block.c
@@ -313,7 +313,7 @@ int main(int argc, char *argv[])
      * Virtually all clients should do this unless you really know what you
      * are doing.
      */
-    if (!SSL_set1_host(ssl, hostname)) {
+    if (!SSL_set1_dnsname(ssl, hostname)) {
         printf("Failed to set the certificate verification hostname");
         goto end;
     }
diff --git a/demos/guide/quic-multi-stream.c b/demos/guide/quic-multi-stream.c
index d08ab4dac19..7e6777d6a43 100644
--- a/demos/guide/quic-multi-stream.c
+++ b/demos/guide/quic-multi-stream.c
@@ -231,7 +231,7 @@ int main(int argc, char *argv[])
      * Virtually all clients should do this unless you really know what you
      * are doing.
      */
-    if (!SSL_set1_host(ssl, hostname)) {
+    if (!SSL_set1_dnsname(ssl, hostname)) {
         printf("Failed to set the certificate verification hostname");
         goto end;
     }
diff --git a/demos/guide/tls-client-block.c b/demos/guide/tls-client-block.c
index 4536b1ffa09..8b51d6d8421 100644
--- a/demos/guide/tls-client-block.c
+++ b/demos/guide/tls-client-block.c
@@ -194,7 +194,7 @@ int main(int argc, char *argv[])
      * Virtually all clients should do this unless you really know what you
      * are doing.
      */
-    if (!SSL_set1_host(ssl, hostname)) {
+    if (!SSL_set1_dnsname(ssl, hostname)) {
         printf("Failed to set the certificate verification hostname");
         goto end;
     }
diff --git a/demos/guide/tls-client-non-block.c b/demos/guide/tls-client-non-block.c
index 3103e6725b8..31920acffc2 100644
--- a/demos/guide/tls-client-non-block.c
+++ b/demos/guide/tls-client-non-block.c
@@ -273,7 +273,7 @@ int main(int argc, char *argv[])
      * Virtually all clients should do this unless you really know what you
      * are doing.
      */
-    if (!SSL_set1_host(ssl, hostname)) {
+    if (!SSL_set1_dnsname(ssl, hostname)) {
         printf("Failed to set the certificate verification hostname");
         goto end;
     }
diff --git a/demos/http3/ossl-nghttp3.c b/demos/http3/ossl-nghttp3.c
index 5be7b1a52cd..942a99acc9b 100644
--- a/demos/http3/ossl-nghttp3.c
+++ b/demos/http3/ossl-nghttp3.c
@@ -416,7 +416,7 @@ OSSL_DEMO_H3_CONN *OSSL_DEMO_H3_CONN_new_for_addr(SSL_CTX *ctx, const BIO_ADDRIN
     qconn_bio = NULL;
 
     /* Set the hostname we will validate the X.509 certificate against. */
-    if (SSL_set1_host(qconn, bare_hostname) <= 0)
+    if (SSL_set1_dnsname(qconn, bare_hostname) <= 0)
         goto err;
 
     /* Configure SNI */
diff --git a/demos/sslecho/main.c b/demos/sslecho/main.c
index 4d4fc969739..a26ebc0ce73 100644
--- a/demos/sslecho/main.c
+++ b/demos/sslecho/main.c
@@ -309,7 +309,7 @@ int main(int argc, char **argv)
         /* Set hostname for SNI */
         SSL_set_tlsext_host_name(ssl, rem_server_ip);
         /* Configure server hostname check */
-        if (!SSL_set1_host(ssl, rem_server_ip)) {
+        if (!SSL_set1_dnsname(ssl, rem_server_ip)) {
             ERR_print_errors_fp(stderr);
             goto exit;
         }