Re: [TLS] [certid] [secdir] secdir review of draft-saintandre-tls-server-id-check-09

[Marsh Ray <[e-mail]>]

On 09/22/2010 04:10 PM, Nasko Oskov wrote:
>
> Or much simpler explanation. Gmail most likely uses SNI on the server
> side to select the proper certificate based on the client requesting
> host name. openssl s_client doesn't send the SNI to the server, so
> the default of mail.google.com is returned. If you use a browser with
> support for SNI, you won't see an error, since you get a proper
> cert.
>
> Just my own interpretation on what happens.

Yep, that's it. I was able to get a gmail.com certificate out of the 
server by using a client which sent SNI.

On 09/22/2010 04:17 PM, Martin Rex wrote:
 > I'm confused about the IE8 vs. IE9 behaviour that you report--
 > could it be that for your IE8 is running on a platform that
 > does not implement TLS extensions (XP,2003) or has the
 > TLSv1.x protocols disabled for some reason?

Yep, svr2k3r2.

The Qualys SSL Labs assessment tool doesn't send SNI so consequently it 
gives all 'F's.
https://www.ssllabs.com/ssldb/analyze.html?d=gmail.com

Gmail.com may be the first major site to depend on SNI for proper operation.

So next time you hear someone saying they can't implement https because 
their site can't get its own IP yet it's too important to rely on 
extensions...

- Marsh