Re: shared SSL

From: Alun Jones (alun@texis.com)
Date: 12/12/02 

From: alun@texis.com (Alun Jones)
Date: Thu, 12 Dec 2002 12:05:34 GMT

In article <OvW3Z9aoCHA.1624@TK2MSFTNGP10>, "Thomas Deml [Msft]"
<thomad@online.microsoft.com> wrote:
>I have to agree that this is kind of unfortunate. As you already mentioned,
>IIS always routes to the first site configured for SSL on a particular IP
>address. The UI allows you to configure multiple SSL sites on the same IP,
>but IIS would never route requests to a second site. Not even wildcard certs
>(*.domainname.com) would help, because the routing to a particular site is
>done before the cert is used for decryption. IIS would have to evaluate the
>request twice before it routes:
>1) When the request comes in a cert has to be found for the IP:Port
>combination. The cert is used to decrypt the request.
>2) When the request is decrypted the host-header becomes available (it came
>in encrypted) - now IIS can route to a host-header based site.

Of course, once everyone implements the suggestions in
http://www.ietf.org/internet-drafts/draft-ietf-tls-extensions-05.txt, there
will be an alternative, since one of the suggestions in that draft is to
provide a ClientHello optional extension that describes the name of the server
being connected to, and thus allows the server to choose which server
certificate to return.

Any ideas when Microsoft is going to extend their TLS implementation, and the
SChannel API, to support this?

[Note: while the document is still a 'draft', the IESG is currently actively
considering making this into a Proposed Standard RFC]

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.] 

-- 
Texas Imperial Software   | Try WFTPD, the Windows FTP Server. Find us at
1602 Harvest Moon Place   | http://www.wftpd.com or email alun@texis.com
Cedar Park TX 78613-1419  | VISA/MC accepted.  NT-based sites, be sure to
Fax/Voice +1(512)258-9858 | read details of WFTPD Pro for XP/2000/NT.

Relevant Pages

  • Re: Page Cannot Be Displayed Errors
    ... In WFetch, for Advanced Request, change to "Add Headers" and write: ... > directly on the web server, ... >>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
    (microsoft.public.inetserver.iis)
  • Re: Performance question (IIS 6)
    ... The delay on the first request is due to interaction between IIS process ... You can do this yourself by making a request to the necessary application ... Turn off all the application pool recycling parameters except maybe the ... until you reboot the server. ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... not IIS, but something else. ... >>> directly on the web server, ... >>>>> I have done some additional checking in the logs. ... >>>>> either the request isn't even getting to IIS at this point, ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... "Jesse" wrote in message ... >> In WFetch, for Advanced Request, change to "Add Headers" and write: ... >>> directly on the web server, ... >>>>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... I have remote access to the server through Remote Desktop, ... Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ... following through with the request, ... > It sounds like you are quite close to the webserver. ...
    (microsoft.public.inetserver.iis)