Re: [TLS] Verifying X.509 Certificate Chains out of order

[Nelson B Bolyard <nelson at bolyard.me>]

Peter Gutmann wrote, On 2008-10-12 00:05:
> Nelson B Bolyard <nelson at bolyard.me> writes:

>> - Client certs are requested in EVERY handshake.
>> [...]
>> - If the server receives a client certificate that it does not recognize
>>  as being authorized to authenticate any user, instead of ignoring the
>>  cert, and going on to request authentication using one of the other
>>  methods (e.g. user name and password), it drops the connection, usually
>>  without sending any alert.
> 
> Hmm, that's new, the behaviour I saw was that the servers always asked for
> certs but when sent a no-cert response they continued as normal.  What you're
> seeing could just be a variant of the same broken behaviour, only now the
> server does a bit more checking and fails on the cert it doesn't know it's
> asked for rather than just ignoring it.

I think we've been seeing the behaviors of the same product.
As you say, if you send a no-certificate response, the server continues
in the "normal" (no client auth) fashion.  But if you DO provide a client
cert, then the server drops the connection.
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls