[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Distribution of Authentication Certificates

On Thu, Mar 27, 2003 at 03:02:05PM +0100, Julian Mehnle wrote:
> > mozilla has some code to allow matching multiple hosts with the cn
> > (you can list them, and I think something like *.foo.bar is also
> > possible). Dunno if that is standardised somewhere.
> Netscape 4- uses the following scheme:
> http://wp.netscape.com/eng/security/ssl_2.0_certificate.html#Site
> (See "Subject Common Name" a bit further down)

The real problem is not the CN, but the certificate which the server
present. There is no way (other than having multiple ip addresses) for a
server to know which hostname was requested before the SSL handshake is
ended. This means, if you have domain1.com and domain2.com on a single name
based virtual server, you cant ship a certificate for the requested domain.

*.com or  {domain1,domain2}.com

are of course not a real solution. Personally I think it is good that IE
does not allow such a complicated pattern matching, and most CAs wont
vertify wildcard certificates, also.

  (OO)      -- Bernd_Eckenfels@Wendelinusstrasse39.76646Bruchsal.de --
 ( .. )  ecki@{inka.de,linux.de,debian.org} http://home.pages.de/~eckes/
  o--o     *plush*  2048/93600EFD  eckes@irc  +497257930613  BE5-RIPE
(O____O)  When cryptography is outlawed, bayl bhgynjf jvyy unir cevinpl!

Reply to: