https dial should check host against certificate

[rsc]

The code in package http that handles https
does not call Certificate.IsValidForHost.  Oops.

Adam, what's the right call?  Use the host name
in the URL, I assume.

How about for SMTP?  What host name do we use there?

[agl]

Comment 1:

Yes, for HTTPS we should use the host from the URL. Does IsValidForHost actually work on
non-Linux systems yet? Last I knew we didn't have a root CA set for those systems
(although I haven't been paying enough attention.)
For SMTP, I think the TLS connection is just opportunistic.

[rsc]

Comment 2:

We have a root CA set for all but Snow Leopard.
I'm working on being able to ask Snow Leopard to check the chain for us.
Will send a CL for https.
For SMTP we can probably check against the advertised
host name from the greeting, so that at least the auth
mechanisms can be given a useful name.
I'm not sure what to do about self-signed things.
Maybe crypto/tls should have a public interface for
adding trusted certificates.

[rsc]

Comment 3:

This issue was closed by revision a4514c4.

Status changed to Fixed.