Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Michael D'Errico <[e-mail]>]

Martin Rex wrote:
> 
> TLS does not need to know anything about DNS (server) names involved
> in a communication.  That is, and has always been, clearly specified
> by all versions of TLS to be entirely an application matter.

There is never a clear line you can draw between one layer and another,
such that no TLS layer will ever reach higher toward an application, or
that no application will reach lower toward the TLS layer.

In my TLS code, there is a simple configuration scheme that applications
use to tell the TLS layer which domain names map to which certificate
chains.  Once set up, the application doesn't need to do anything more
since the TLS code then handles certificate selection based on the SNI,
version, cipher suite, supported signature algorithms, and key usage.
It's quite complicated.

You might condemn this as some sort of layering violation, but it really
does make life easier for application writers.  I wrote the code once
instead of requiring every application writer to have to reinvent it.

Mike