Subject: [TLS] TLS extension for Proxies to transfer original Server certificate
From: "Babu.N" <[email-masked]>
To: [email-masked]
Date: Tue, 28 Aug 2007 11:15:54 +0530
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>

Hi,

I have submitted a draft on "
TLS extension for Proxies to transfer Server certificate
":http://www.ietf.org/internet-drafts/draft-babu-serv-cert-trans-from-proxy-00.txt

Intercepting transparent proxies splice the client-Server connection 
into two connections: Client-Proxy connection, Proxy-server 
connection. On Client-Proxy connection, proxy sends it's certificate 
to the client. As client is generally (in such a scenario) 
pre-configured to accept proxy's certificate, client accepts and 
proceeds further with the connection. On Proxy-Server connection, 
server sends its certificate to the proxy. Proxy typically doesn't 
possess the information (like MX domain name in case of SMTP) 
required to validate the certificate. The certificate validation is 
at times very complex & hence it is better to offload this 
responsibility to the original client itself.

This document addresses this issue by extending TLS to let proxy send 
server's certificate to the client for validation and suggests how 
client can indicate certificate validation result to the proxy. Based 
on the client's decision, proxy can determine whether to 
proceed/terminate the connection.

Like to hear feedback on this.

Thanks,
Babu

********************************************************************************
This email message (including any attachments) is for the sole use of the intended recipient(s) 
and may contain confidential, proprietary and privileged information. Any unauthorized review, 
use, disclosure or distribution is prohibited. If you are not the intended recipient, 
please immediately notify the sender by reply email and destroy all copies of the original message. 
Thank you.
 
Intoto Inc. 

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls