Re: [TLS] TLS 1.3 certificate delegation?

[[e-mail] (Martin Rex)]

Carl Wallace wrote:
> >
> >Interesting -- I'd never noticed that.
> >
> >That being said, proxy certificates are essentially useless unless all
> >clients support them.  In the absence of mandatory support or a client
> >extension indicating acceptance of proxy certificates, they won't be
> >used.
> 
> Of course, but the same goes for notional hybrid server/CA certificates
> too, no?  There is apparently some support for proxy certificates in
> Apache.  I've no idea what it's used for or how well it works though.  

The TLS implementations that have the least excuse for ignoring
what travels in the Server's Certificate TLS handshake
message are the TLS clients -- and TLS clients outnumber TLS servers
by maybe three orders of magnitudes.

What Apache consciously/officially supports might be largely irrelevant
when OpenSSL is used -- because that seems to blissfully send arbitrary
data from two files (cert and chain) provided that the contents
can be ASN.1 decoded as X.509v3 containers.  So whatever the admin
manages to put in these files, Apache will send obediently and with
eyes closed. 

-Martin