Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Nikos Mavrogiannopoulos <[e-mail]>]

Joseph Salowey (jsalowey) wrote:
> OK with me, so we have:
> 
> "The ServerNameList MUST NOT contain more than one name of the same
> name_type. If the server understood the client hello extension, but
> refuses to continue because it does not recognize the server name, it
> MUST send a fatal unrecognized_name(112) alert and terminate the
> handshake.  If the server decides to continue the  handshake, sending a
> warning-level unrecognized_name(112) alert is NOT RECOMMENDED, since
> existing  client behavior is unpredictable. A TLS client implementation
> that receives a warning-level unrecognized_name(112) alert SHOULD ignore
> this alert and continue the TLS handshake.  If there is a mismatch
> between the server name used by the client application and the server
> name of the default credential chosen by the server, this mismatch will
> become apparent when the client application performs the server endpoint
> identification, at which point the client application will have to
> decide whether to proceed with the communication.  TLS implementations
> are encouraged to make information available to application callers
> about warning-level alerts that were received during a TLS handshake.
> Such information can be useful for diagnostic purposes. "

It is ok with me. My only reservation would be "... sending a
warning-level unrecognized_name(112) alert is NOT RECOMMENDED ...". One
might deduce, ok let's send some other alert to indicate the situation.
I'd prefer "... sending any warning-level alert to indicate this
situation is NOT RECOMMENDED ..."

regards,
Nikos