Right, that's what I figured. Trouble is, if I chose TO proxy, they I must have my peer to the remote server act as if it sent the same client hello so as to have the same challenge bytes. AFAIK, there is no openssl mechanism to set this prior to sending a client hello.
-----Original Message----- From: [email protected] on behalf of Victor Duchovni Sent: Fri 8/28/2009 7:40 PM To: [email protected] Subject: Re: Can I set the client hello challenge externally? On Fri, Aug 28, 2009 at 03:19:26PM -0700, Rene Hollan wrote: > Sorry, still don't get it: the DH exchange hasn't taken place YET when > client sends Client Hello and server responds with Server Hello, and > Server Certificate(s). > > Should I still not have the freedom to chose at that point whether to > proxy or not? You can choose to not proxy, provided you have not changed any messages between the client and the server, and have not replaced the server certificate with one signed by the proxy. -- Viktor. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
