Subject: Re: Scale (and the SRV record)

From: [email-masked]
Date: Wed, 4 Nov 1998 22:02:24 -0800

I've seen clients fail SSL connection because the supplied server
certificate wasn't manufactored by a CA in the included browswer list.

I've yet to see a client fail an SSL connection because it was the first
time it had ever encountered a particular server certificate ... had
absolutely no record of the particular server certificate or prior
knowledge of the particular server (the only characteristic for succesful
SSL seems to be that the server's certificate was manufactored by CA known
in the browser list).

URL is better than nothing ... but it just says that the URL and the
certificate is the same. Most instances of https invokation is a button on
a web-page. It is possible to make sure that the button does in fact invoke
a URL that matches the certificate ... and it still be an exploit.

---

From: Stephen Kent <[email-masked]>
Date: Thu, 5 Nov 1998 07:56:49 -0500

Lynn,

 <duplicate text deleted> ...
>a URL that matches the certificate ... and it still be an exploit.

The URL against which the match is made is the one associated with the
current SSL session. Since the match is on the DNS name portion, page
differences within the same server are not an issue.  In fact, some
browsers adopt a star-name matching rule and thus allow a match for any of
a series of servers with the same name suffix, e.g., *server.foo.bar.com.

Steve