Subject: Re: [TLS] SSL Renegotiation DOS
From: "Steve Dispensa" <[email-masked]>
To: "Nikos Mavrogiannopoulos" <[email-masked]>, "Jorge A. Orchilles" <[email-masked]>
Cc: [email-masked]
Date: Tue, 15 Mar 2011 08:23:44 -0500
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Nikos Mavrogiannopoulos
>
> Hello,
>  I'm curious, what is the effect of that in typical HTTPS servers? Do
> servers allow
> for renegotiation initiated by the client? (apache with mod_gnutls
> doesn't)

When we looked at implementations last year, we found that IIS was definitely not willing to do client-initiated renegotiation, but at the time there were a few that would. I'm sure a lot has changed since I last looked at it.

 -Steve