Re: [TLS] Renegotiation and client authentication

[Yoav Nir <[e-mail]>]

On Mon, Mar 10, 2014 at 10:14 AM, Martin Thomson
<[e-mail]>wrote:

> On 9 March 2014 23:22, Yoav Nir <[e-mail]> wrote:
> >  1. Always request a client certificate
>
> FYI, most software has a secondary configuration on this point:
> whether to reject the connection if a certificate is not provided.
> This makes the request from the server optional to comply with (or
> not).
>

Yes, but the user experience is the same whether the server has marked the
client authentication as optional or mandatory - the browser pops us a
certificate selector, and you don't want that on the landing page.

> You also need a document describing how HTML or HTTP is used to trigger
> such a connection
>
> http://datatracker.ietf.org/doc/draft-thomson-httpbis-catch/
>

I would have preferred a response code (like "4xx client authentication
needed"), but this works as well.

How does the server tell new clients (that support this extension) apart
from older clients, for which you still have to use renegotiation (in TLS
1.2 or course...)? Sending this to old clients would result in breakage.

Yoav