Re: Allow matching whole DN from a client certificate

> On 11 Nov 2020, at 21:44, Andrew Dunstan <andrew@dunslane.net> wrote:

> If people like this idea I'll add tests and docco and add it to the next CF.

Sounds like a good idea, please do.

Can this case really happen in non-ancient OpenSSL version?
+        if (!x509name)

Doesn't this returnpath need a pfree(peer_cn)?
+        bio = BIO_new(BIO_s_mem());
+        if (!bio)
+        {
+            return -1;
+        }

cheers ./daniel