Subject: Re: [Sip] TLS post connection verification

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 03 Apr 2003 04:12:11 -0500

Cullen Jennings wrote:
> If element A wants to send a SIP message over TLS to a next hop called
> foo.com, A needs to check that the SubjectAltName in the certificate
> provided over the TLS connection to A matches foo.com. Openssl can not do
> this for you automatically, A needs to call the SSL_get_peer_certificate
> after A has connected. foo.com may request, and look at, the certificate of
> A or may not depending on if mutual TLS is being done or not.

Right. The question was, would the server do an equivalent 
post-connection validation based on that certificate. The answer is that 
it depends. In the case of a peering relationship between proxies, it 
would probably check the subjectAltName against a list of valid peers, 
and it would be a matter of policy about whether to accept or reject 
requests identified as coming from users in that domain or other domains 
(for example, rfc3325). You can also use mutual TLS to authenticate a 
UAC, typically a UAC which is an application server of some sort. The 
same kind of policy would applied depending on the type of requests the 
application was needing to generate.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Scientist                             Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip