> > Our clients are not certified if they don't verify the server cert. > > The server can't be verify this during the handshake. If you control > the > client software, then perhaps you can be confident that the software in > question always verifies the server cert.
I should be more clear -- as a policy, we require all of our clients doing the server cert. verification (quite basic, hnh?). > > Though > > impersonate is an issue, our security folks are also concerned about > the > > privacy of existing sessions and newly created sessions -- which I > don't > > think valid in our case. > > Server cert verification is sufficient for this, the client does not > need > a client cert for this, so disclosure of any such cert does not break > MITM > resistance. To be exact, disclosure of client private key. Thanks, Joe G. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
