Re: [TLS] [certid] [secdir]

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> On 09/22/2010 04:17 PM, Martin Rex wrote:
>  > I'm confused about the IE8 vs. IE9 behaviour that you report--
>  > could it be that for your IE8 is running on a platform that
>  > does not implement TLS extensions (XP,2003) or has the
>  > TLSv1.x protocols disabled for some reason?
> 
> Yep, svr2k3r2.
> 
> The Qualys SSL Labs assessment tool doesn't send SNI so consequently it 
> gives all 'F's.
> https://www.ssllabs.com/ssldb/analyze.html?d=gmail.com
> 
> Gmail.com may be the first major site to depend on SNI for proper operation.
> 
> So next time you hear someone saying they can't implement https because 
> their site can't get its own IP yet it's too important to rely on 
> extensions...

If it was only about these two services hosted on a single TLS server,
it would be trivial to fix by employing a single TLS server cert
containing DNS-IDs for both hostnames.  That would obviate the use
of SNI.  While it is helpful to have a publicly accessible server
to test A clients SNI functionality, this should probably be done
with a seperate test server and not a productive public system... :-]


I'm really confused to see a company like google use TLS server certs
that do not contain any DNS-IDs at all -- considering the
proposals for TLS enhancements they have on the oven and are
shipping in their software (e.g. Google Chrome).

Is it that the particular CA they have chosen is unable or unwilling
to issue state-of-the-art TLS server certs (i.e. certs with DNS-IDs)?
 

-Martin