On Fri, Jan 22, 2010 at 04:39:43AM +0100, Dr. Stephen Henson wrote:
> On Thu, Jan 21, 2010, fredk2 wrote:
>
> >
> > do I understand this correctly:
> > 0.9.8m sends a no_renegotiation alert and apache needs a mod_ssl patch that,
> > by default, upon this alert closes the connection?
> >
>
> No this isn't Apache's fault. OpenSSL 0.9.8m sends the no_renegotiation alert
> it's just the OpenSSL before 0.9.8m ignores it.
What does this mean, more generally, for interoperability of patched
and unpatched TLS clients and servers? What are the problem use-cases
and failure modes?
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
