Martin Rex <Martin.Rex at sap.com> writes: >Microsoft's implementation (which could be the one referred to by >Larry's implementation) has a silly design flaw in its TLS renogiation, >and I'm not sure that the previous text is a way to fix it. > >It is possible to configure Microsoft IIS in a fashion so that it >will first perform a TLS handshake with a server-only authentication, >and after having received the HTTP request, it will re-negotiate and >ask for a client certificate. It's not necessarily a design flaw, AFAIK it's a performance optimisation to avoid the server having to maintain state/leave a connection open for an arbitrary amount of time while the user fumbles around with smart cards and certificates and whatnot. Peter.
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.