@@ -7296,10 +7296,12 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
72967296 </para>
72977297
72987298 <para>
7299- In <literal>verify-full</> mode, the <literal>cn</> (Common Name) attribute
7300- of the certificate is matched against the host name. If the <literal>cn</>
7301- attribute starts with an asterisk (<literal>*</>), it will be treated as
7302- a wildcard, and will match all characters <emphasis>except</> a dot
7299+ In <literal>verify-full</> mode, the host name is matched against the
7300+ certificate's Subject Alternative Name attribute(s), or against the
7301+ Common Name attribute if no Subject Alternative Name of type dNSName is
7302+ present. If the certificate's name attribute starts with an asterisk
7303+ (<literal>*</>), the asterisk will be treated as
7304+ a wildcard, which will match all characters <emphasis>except</> a dot
73037305 (<literal>.</>). This means the certificate will not match subdomains.
73047306 If the connection is made using an IP address instead of a host name, the
73057307 IP address will be matched (without doing any DNS lookups).