[1.26] Add test to complete the coverage of urllib3.util.ssl_match_ho…

…stname.match_hostname

test/conftest.py

@@ -103,6 +103,16 @@ def no_san_server(tmp_path_factory):
         yield cfg
 
 
+@pytest.fixture()
+def no_san_server_with_different_commmon_name(tmp_path_factory):
+    tmpdir = tmp_path_factory.mktemp("certs")
+    ca = trustme.CA()
+    server_cert = ca.issue_cert(common_name=u"example.com")
+
+    with run_server_in_thread("https", "localhost", tmpdir, ca, server_cert) as cfg:
+        yield cfg
+
+
 @pytest.fixture
 def no_san_proxy(tmp_path_factory):
     tmpdir = tmp_path_factory.mktemp("certs")

test/with_dummyserver/test_https.py

@@ -858,6 +858,19 @@ def test_warning_for_certs_without_a_san(self, no_san_server):
                 assert r.status == 200
                 assert warn.called
 
+    def test_common_name_without_san_with_different_common_name(
+        self, no_san_server_with_different_commmon_name
+    ):
+        with HTTPSConnectionPool(
+            no_san_server_with_different_commmon_name.host,
+            no_san_server_with_different_commmon_name.port,
+            cert_reqs="CERT_REQUIRED",
+            ca_certs=no_san_server_with_different_commmon_name.ca_certs,
+        ) as https_pool:
+            with pytest.raises(MaxRetryError) as cm:
+                https_pool.request("GET", "/")
+            assert isinstance(cm.value.reason, SSLError)
+
 
 class TestHTTPS_IPV4SAN:
     def test_can_validate_ip_san(self, ipv4_san_server):