WP_Http_Streams::verify_ssl_certificate( resource $stream, string $host ): bool

429	public static function verify_ssl_certificate( $stream, $host ) {430		$context_options = stream_context_get_options( $stream );431 432		if ( empty( $context_options['ssl']['peer_certificate'] ) ) {433			return false;434		}435 436		$cert = openssl_x509_parse( $context_options['ssl']['peer_certificate'] );437		if ( ! $cert ) {438			return false;439		}440 441		/*442		 * If the request is being made to an IP address, we'll validate against IP fields443		 * in the cert (if they exist)444		 */445		$host_type = ( WP_Http::is_ip_address( $host ) ? 'ip' : 'dns' );446 447		$certificate_hostnames = array();448		if ( ! empty( $cert['extensions']['subjectAltName'] ) ) {449			$match_against = preg_split( '/,\s*/', $cert['extensions']['subjectAltName'] );450			foreach ( $match_against as $match ) {451				list( $match_type, $match_host ) = explode( ':', $match );452				if ( strtolower( trim( $match_type ) ) === $host_type ) { // IP: or DNS:453					$certificate_hostnames[] = strtolower( trim( $match_host ) );454				}455			}456		} elseif ( ! empty( $cert['subject']['CN'] ) ) {457			// Only use the CN when the certificate includes no subjectAltName extension.458			$certificate_hostnames[] = strtolower( $cert['subject']['CN'] );459		}460 461		// Exact hostname/IP matches.462		if ( in_array( strtolower( $host ), $certificate_hostnames, true ) ) {463			return true;464		}465 466		// IP's can't be wildcards, Stop processing.467		if ( 'ip' === $host_type ) {468			return false;469		}470 471		// Test to see if the domain is at least 2 deep for wildcard support.472		if ( substr_count( $host, '.' ) < 2 ) {473			return false;474		}475 476		// Wildcard subdomains certs (*.example.com) are valid for a.example.com but not a.b.example.com.477		$wildcard_host = preg_replace( '/^[^.]+\./', '*.', $host );478 479		return in_array( strtolower( $wildcard_host ), $certificate_hostnames, true );480	}