Re: [TLS] RESOLVED (Re: [sasl] lasgt call comments (st Call:

[Peter Gutmann <pgut001 at cs.auckland.ac.nz>]

Martin Rex <Martin.Rex at sap.com> writes:

>Microsoft's implementation (which could be the one referred to by
>Larry's implementation) has a silly design flaw in its TLS renogiation,
>and I'm not sure that the previous text is a way to fix it.
>
>It is possible to configure Microsoft IIS in a fashion so that it
>will first perform a TLS handshake with a server-only authentication,
>and after having received the HTTP request, it will re-negotiate and
>ask for a client certificate.

It's not necessarily a design flaw, AFAIK it's a performance optimisation to 
avoid the server having to maintain state/leave a connection open for an 
arbitrary amount of time while the user fumbles around with smart cards and 
certificates and whatnot.

Peter.