Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Peter Sylvester <[e-mail]>]

> TLS does not need to know anything about DNS (server) names involved
> in a communication.  That is, and has always been, clearly specified
> by all versions of TLS to be entirely an application matter.
>    
... and a server doesn't need to have a DNS name at all.

I am not whether I understand (or ever understood) what
SNI is for, at least I'd say that if an application protocol that
uses dns names to identify different application level endpoints
(which is common due to ip address shortage),
and if the application wants to use different TLS protection
mechanisms for each of the endpoints, or , when the
client part would expect this as a possibility, either in general
for the application or in particular for the intended
communication, the  client protocol client needs
a way to communicate the desired dnsname to TLS layer
and to the application entity,  the latter not necessarily in theory
if TLS is always used. SNI is one way to do the first.

A priori, it has nothing to do with certificates,
in SRP/TLS authentication one may not even have such things,
in practice, for at least one not totally unimportant protocol,
the only "visible" effect is the usage of different certificates to
be used for authentication.

an (theoretical) application protocol for example could
require an IP matching address in order to recognize
a server endpoint.

Peter