Subject: Re: [TLS] Summary of discussion regarding spontaneuous authentication

From: Peter Gutmann <[email-masked]>
Date: Tue, 28 Oct 2014 09:55:08 +0000

Eric Rescorla <[email-masked]> writes:

>If we make this change, we could still leave CertificateRequest in place, but
>it could be empty, just indicating that the server wants some kind of client
>auth and let the client decide. 

Just as a data point, I've always done it that way, the client provides
whatever cert it has to get in and the server decides whether it'll allow
access.  I've never had any reports of problems so far.

(Caveat: Given the almost nonexistent use of client certs the sample size
there probably isn't very large).

Peter.