Subject: Re: Scale (and the SRV record)

From: [email-masked]
Date: Wed, 4 Nov 1998 21:42:55 -0800

you must live on another part of the internet than i do.

I've seen clients fail SSL connection because the supplied server
certificate wasn't manufactored by a CA in the included browswer list.

I've yet to see a client fail an SSL connection because it was the first
time it had ever encountered a particular server certificate ... had
absolutely no record of the particular server certificate or prior
knowledge of the particular server (the only characteristic for succesful
SSL seems to be that the server's certificate was manufactored by CA known
in the browser list).

---

From: Stephen Kent <[email-masked]>
Date: Thu, 5 Nov 1998 07:53:45 -0500

Lynn,

>you must live on another part of the internet than i do.

Well, working for the company that pioneered Internet technology, I may
live in a better neighborhood :-).

>certificate wasn't manufactored by a CA in the included browswer list.

Of course that's true, but that does not disagree with my observation;
first one authenticates the server cert, then one matches it against the
server URL.  You're just seeing a failure of the first part of a two stage
mechanism.

>SSL seems to be that the server's certificate was manufactored by CA known

First time has nothing to do with this, Lynn.  Review the description for
how SSL processing of server certs works.

Steve

---

From: EKR <[email-masked]>
Date: 05 Nov 1998 04:58:24 -0800

> certificate wasn't manufactored by a CA in the included browswer list.
Of course. 

> SSL seems to be that the server's certificate was manufactored by CA known
Lynn, this simply isn't correct.

There are two major checks for a server certificate:
1. That it's descended from a trust point.
2. That it contain a name that corresponds to the URL that the
client thinks it's dereferencing. 

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]