Re: [TLS] Multiple domain names in SNI (was Questions about TLS

[Michael D'Errico <[e-mail]>]

They could share IP addresses.

But the point is that you and I don't know for certain that there is
no possible requirement for a client to send multiple hostnames, so
imposing a limitation of only one hostname could preclude some future
application from being able to use TLS (without modifications or
private agreement).

If it was hard to implement checking for a match in a list, I'd agree
with you, but literally it is a simple while loop that calls your
lookup function for each name in the SNI extension.

Mike



Martin Rex wrote:
> Michael D'Errico wrote:
>> Here's a possible reason for a client to include multiple domain
>> names in the SNI.  Suppose a user enters "foo.edu" into their
>> browser.  The browser may decide to send the two names "foo.edu"
>> and also "www.foo.edu" to the server in an attempt to connect on
>> the first try, rather than get rejected on the first connection
>> and have the overhead of retrying.
> 
> I'm sorry, I don't understand you scenario.
> 
> Current implementations of TCP can have only two communication peers,
> not three and the TLS handshake works also only with two participants,
> server and client.
> 
> The client MUST know which of the hostnames was used to open a particular
> network connection, so there is NO situation where more than one name
> should go into SNI here.
> 
> -Martin