Re: [radext] Server identity and RFC7585bis

[Alan DeKok <[e-mail]>]

  So summarize my thoughts a little more clearly;

RFC 7585 clients SHOULD use SNI.  This information can be used by a server which handles multiple realms, in order to present a matching certificate for that realm.

Other TLS clients MAY use SNI.  The SNI realm SHOULD be configured by the administrator of the RADIUS client.  The SNI realm does not need to be the same as any realm in packets sent by the client.

TLS connections MUST operate application-layer watchdog checks as per RFC 3559 Section 3.4.  TLS connections SHOULD also enforce idle timeouts, lifetimes, etc.

TLS connection liveliness checks MUST be applied on a per-connection basis.  There may be other connections to the same destination which are up and active.

Other issues of load-balancing, multiple connections to the same destination, etc. are outside of the scope of this document.

  Alan DeKok.