From 7c0d632687721c68b99210fda0929292a2775dfa Mon Sep 17 00:00:00 2001
From: Niklas Hofer <niklas+dev@lanpartei.de>
Date: Tue, 30 Jun 2026 12:08:44 +0200
Subject: [PATCH] (hack) fix handshake failure caused by wildcard-nonmatch

TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2186 generated CLIENT ALERT: Fatal - Handshake Failure
 - {:bad_cert,
 {:hostname_check_failed, {:requested, ~c"fcm.googleapis.com"},
  {:received,
   [
     dNSName: ~c"upload.video.google.com",
     dNSName: ~c"*.clients.google.com",
     dNSName: ~c"*.docs.google.com",
     dNSName: ~c"*.drive.google.com",
     dNSName: ~c"*.gdata.youtube.com",
     dNSName: ~c"*.googleapis.com",
     dNSName: ~c"*.photos.google.com",
     dNSName: ~c"*.youtube-3rd-party.com",
     dNSName: ~c"upload.google.com",
     dNSName: ~c"*.upload.google.com",
     dNSName: ~c"upload.youtube.com",
     dNSName: ~c"*.upload.youtube.com",
     dNSName: ~c"uploads.stage.gdata.youtube.com",
     dNSName: ~c"bg-call-donation.goog",
     dNSName: ~c"bg-call-donation-alpha.goog",
     dNSName: ~c"bg-call-donation-canary.goog",
     dNSName: ~c"bg-call-donation-dev.goog"
   ]}}}
---
 lib/pigeon/fcm/config.ex | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/pigeon/fcm/config.ex b/lib/pigeon/fcm/config.ex
index c41243a..f5cc06e 100644
--- a/lib/pigeon/fcm/config.ex
+++ b/lib/pigeon/fcm/config.ex
@@ -79,6 +79,12 @@ defimpl Pigeon.Configurable, for: Pigeon.FCM.Config do
         {:active, :once},
         {:packet, :raw},
         {:reuseaddr, true},
+        # HACK fcm.googleapis.com gives back a cert with '*.googleapis.com', but by
+        # default, :ssl.connect does not accept wildcards here. Provising
+        # server_name_indication does not produce another cert
+        {:customize_hostname_check, [
+            match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
+          ]},
         {:alpn_advertised_protocols, [<<"h2">>]}
       ]
       |> add_port(config)