GmCerts: Relaxed domain verification

Allow a certificate for a higher-level domain to be verified against any subdomains, i.e., implicitly assume every certificate uses wildcards.

CA verification is still done separately, and OpenSSL does that strictly as before.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/gmrequest.c b/src/gmrequest.c
index f065f935..c968990c 100644
--- a/src/gmrequest.c
+++ b/src/gmrequest.c
@@ -157,7 +157,7 @@ static void checkServerCertificate_GmRequest_(iGmRequest *d) {
         if (!isExpired_TlsCertificate(cert)) {
             resp->certFlags |= timeVerified_GmCertFlag;
         }
-        if (verifyDomain_TlsCertificate(cert, domain)) {
+        if (verifyDomain_GmCerts(cert, domain)) {
             resp->certFlags |= domainVerified_GmCertFlag;
         }
         if (checkTrust_GmCerts(d->certs, domain, cert)) {