Re: [TLS] Multiple domain names in SNI (was Questions about TLS

[Michael D'Errico <mike-list at pobox.com>]

They could share IP addresses.

But the point is that you and I don't know for certain that there is
no possible requirement for a client to send multiple hostnames, so
imposing a limitation of only one hostname could preclude some future
application from being able to use TLS (without modifications or
private agreement).

If it was hard to implement checking for a match in a list, I'd agree
with you, but literally it is a simple while loop that calls your
lookup function for each name in the SNI extension.

Mike



Martin Rex wrote:
> Michael D'Errico wrote:
> > Here's a possible reason for a client to include multiple domain
> > names in the SNI.  Suppose a user enters "foo.edu" into their
> > browser.  The browser may decide to send the two names "foo.edu"
> > and also "www.foo.edu" to the server in an attempt to connect on
> > the first try, rather than get rejected on the first connection
> > and have the overhead of retrying.
>
> I'm sorry, I don't understand you scenario.
>
> Current implementations of TCP can have only two communication peers,
> not three and the TLS handshake works also only with two participants,
> server and client.
>
> The client MUST know which of the hostnames was used to open a particular
> network connection, so there is NO situation where more than one name
> should go into SNI here.
>
> -Martin