This directive sets whether the remote server certificate's CN field is compared against the hostname of the request URL. If both are not equal a 502 status code (Bad Gateway) is sent. SSLProxyCheckPeerCN is superseded by SSLProxyCheckPeerName in release 2.4.5 and later.

In all releases 2.4.5 through 2.4.20, setting SSLProxyCheckPeerName off was sufficient to enable this behavior (as the SSLProxyCheckPeerCN default was on .) In these releases, both directives must be set to off to completely avoid remote server certificate name validation. Many users reported this to be very confusing.

As of release 2.4.21, all configurations which enable either one of the SSLProxyCheckPeerName or SSLProxyCheckPeerCN options will use the new SSLProxyCheckPeerName behavior, and all configurations which disable either one of the SSLProxyCheckPeerName or SSLProxyCheckPeerCN options will suppress all remote server certificate name validation. Only the following configuration will trigger the legacy certificate CN comparison in 2.4.21 and later releases;

Example

SSLProxyCheckPeerCN on
SSLProxyCheckPeerName off