TLS and Usage of "trusted_ca_keys" by server

From: David C. Partridge (afb12_at_dial.pipex.com)
Date: 07/03/03 

Date: Thu, 3 Jul 2003 14:23:04 +0100

In rfc3446, section 3.4 says that a constrained client may send an extension
of type "trusted_ca_keys" to the server to indicate the CAs that it knows
about.

This allows the server to implicitly select a private key and matching
certificate chain that the client can support.

Does this specification preclude the server from using the same technique to
indicate to the client which CAs it is prepared to support, thus allowing
the client to select an appropriate key pair and certificate? The specific
reason I'm asking is that the rfc says at the end of section 3.4:

----- QUOTE -----
Servers that receive a client hello containing the "trusted_ca_keys"
extension, MAY use the information contained in the extension to
guide their selection of an appropriate certificate chain to return
to the client. In this event, the server SHALL include an extension
of type "trusted_ca_keys" in the (extended) server hello.
The "extension_data" field of this extension SHALL be empty.
----- END QUOTE -----

and this would seem to preclude such a possibility

Relevant Pages

  • RE: SoapExtension execution on clientside
    ... WSDL and it looks okay with the namespace for my extension... ... "Hans" wrote: ... > only got a Server Internal Error 500. ... >> I added the classas a reference on the client. ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: Changing the URL defined in SCP
    ... I uninstalled the CAS role from the server [left the hub transport role on ... in SCP is to uninstall the CAS server and then re-install it with the new URL ... being found by your client is the first one that is being returned. ...
    (microsoft.public.exchange.setup)
  • Re: Emailing MP3s
    ... This MP3 was 2.4mb, but I don't think size is a factor. ... If the attachment extension is changed there, it has nothing to do with the ... email client. ... Then the problem is very likely with the mail server used by that one ...
    (microsoft.public.windowsxp.general)
  • Re: Mulberry gone, now what?
    ... All IMAP implementations (client or server) are supposed to implement the IMAP base specification, and work with other implementations that also implement the base specification. ... Extensions exist as a matter of convenience; typically, to make it possible for a client to perform a particular task faster/more efficiently than if the extension was not present. ...
    (comp.mail.imap)
  • Re: Client-Server Requirement
    ... My clint machine and the server ... My user name is added in the tapi server admin ... I mean how can I find the line in a client ... Let me explain my case for two PABX extension. ...
    (microsoft.public.win32.programmer.tapi)