Re: [TLS] draft-rescorla-tls-renegotiate.txt

[Martin Rex <mrex at sap.com>]

Nelson B Bolyard wrote:
> 
> Here is an alternative that should have the same user experience and not
> be MITM vulnerable, not even with SSL 3.0 clients:
> 
>    Replace renegotiation with redirection.
> 
> Set up a second https server (process) on the same physical server, e.g
> a different port on the same IP address.  The new server always requests
> client authentication on the initial handshake, not in a renegotiation.

That is actually what our clients usually have to do since the
OEM SSL/TLS library we provide does not support renegotiation on
the server side (its also not in our apps software layers).

There is one itch I have with this:
A number of Web Proxies (like the one of our company) does not
permit HTTP CONNECT to ports other than 443.

Should we ask for an additional port to be officially allocated
to http-over-ssl-with-client-cert so that we can get this past
our security policy (not joking)?


-Martin