Subject: Some more thoughts on Alt-Svc-SNI

From: Eric Rescorla <[email-masked]>
Date: Tue, 17 Jul 2018 14:41:10 -0700

Was talking to DKG in the hallway and he pointed out that Alt-Svc-SNI works
well for the use case where you have a cert that is valid both for the
original domain (the one you looked up) and the replacement domain (the one
in the SNI). For instance, you want to reach a.example.com and the server
has a cert for *.example.com. This would also have the advantage that you
didn't need to change the Alt-Svc semantics at all.

Maybe it would make sense to re-scope to that case?

-Ekr

---

From: Lou Steinberg <[email-masked]>
Date: Tue, 17 Jul 2018 17:55:03 -0400

That makes sense to me.  It also covers the case that Lutz spoke in support of; essentually using a subdomain of the origin to pass a token to the alternate service in the SNI.  A number of us are interested in that use case.

Apologies for the background noise on the call.  I dropped off so as to not let it be disruptive

Lou

-- 
Lou Steinberg 
Managing Partner 
CTM Insights, llc

Sent from my phone while not driving. Please excuse typos and brevity.