Subject: [TLS] Name recognition for 1+ server name types in server name indication

From: Xuelei Fan <[email-masked]>
Date: Tue, 16 Oct 2012 12:12:46 +0800

Hi,

RFC 6066 defines the extensibility of server name types. If there are
more than one server name types, it is not very clear what's the
expected behaviors of server side if it can recognize one name, but
cannot tell the other one.  For example, suppose there are two name
types, HostName and FutureName. The server side support both of the name
types.  In the server name indication extension, HostName is set to
"www.example.com", and FutureName is set to "In.The.Past".  The server
side can accept HostName "www.example.com", and FutureName "In.The.Future".

     HostName in SNI extension:          "www.example.com"
     FutureName in SNI extension:       "In.The.Past"

     Acceptable HostName in server:     "www.example.com"
     Acceptable FutureName in server:  "In.The.Future"

That is to say, server is able to recognize the name of HostName; but
cannot recognize the name of FutureName.

The question is, what's the expected behaviors of server side?  Accept
the server name indication (include an extension of type "server_name"
in the server hello), or denied the server name indication (send a
fatal-level unrecognized_name(112) alert)?

>From my understand, the proper behaviors maybe denied the server name
indication. Otherwise, because the "server_name" in the server hello is
empty, it is pretty confusing for client to determine which name is
acceptable in server side. The client side may make bad decision if it
regards that the FutureName("In.The.Past") is recognized by the server.

What do you think?

Thanks,
Xuelei Fan