Re: [TLS] TLS 1.3 certificate delegation?

[Andy Lutomirski <[e-mail]>]

On Thu, Nov 7, 2013 at 12:26 PM, Carl Wallace <[e-mail]> wrote:
>>
>>Interesting -- I'd never noticed that.
>>
>>That being said, proxy certificates are essentially useless unless all
>>clients support them.  In the absence of mandatory support or a client
>>extension indicating acceptance of proxy certificates, they won't be
>>used.
>
> Of course, but the same goes for notional hybrid server/CA certificates
> too, no?  There is apparently some support for proxy certificates in
> Apache.  I've no idea what it's used for or how well it works though.
>

Right.

My point is that, if something like this shows up as a mandatory
feature in TLS 1.3, then it becomes usable.  I would use it on
public-facing websites, for example.

--Andy