[TLS] Register port for https+client cert (was Re: draft-rescorla-tls-renegotiate.txt)

[Chris Newman <Chris.Newman at Sun.COM>]

--On November 7, 2009 2:00:45 +0100 Martin Rex <mrex at sap.com> wrote:
> Should we ask for an additional port to be officially allocated
> to http-over-ssl-with-client-cert

This is a good idea.

HTTP authentication is particularly badly designed, but we can't really fix 
it so we have to live with it.  Having a separate port for 
HTTP-with-client-cert-mandatory where the server can "just know" that 
client certs will be present in the initial handshake and will never be 
renegotiated, and the client can "just know" it has to prompt the user for 
client cert selection removes some of the need for all the security 
"fudging" HTTP does and thus is an overall security improvement, IMHO.

I would not want other protocols to copy this mess, however -- application 
protocols should have a clean and simple state transition between "not 
authenticated" and "authenticated" state.  POP, IMAP, XMPP, LDAP, BEEP and 
even Telnet did this better than HTTP.

		- Chris