On Sun, Jun 25, 2000 at 03:16:00PM +0200, Ralf S. Engelschall wrote:
>
> AFAIK the TLS standard will be not changed for this. But there are drafts (or
> are they already final RFCs?) which describe an "upgrade mechanism" for HTTP
> connections which allows one to first send a plain HTTP request (including the
> Host: field), then perform a step-up to SSL/TLS and then transfer the response
> already encrypted. And because here the Host: header is seen before the
> SSL/TLS handshake is performed, this implicitly solves the name based virtual
> hosting issues.
Yes, that was it.
I don't really like the idea very much - it sounds like a dirty hack to me.
And as long as none of the major browsers support it, there's not much fun
in it at all (unless M$ suddenly choose to change that very fast ;-)
I'd much rather see a solution along the lines of adding CNAME's to the
certirficate as x.509v3 extensions[1] or alternatively just wait for ip v6.
[1] No, I'm not working for a CA (any longer) and hoping to sell a few extra
certs by using such a scheme ;-)
vh
Mads Toftum
--
`Darn it, who spiked my coffee with water?!' - lwall
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl) www.modssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
