Re: [TLS] RFC-4366-bis and the unrecognized_name(112) alert

[Paul Hoffman <[e-mail]>]

At 8:12 AM -0700 6/9/10, Joseph Salowey (jsalowey) wrote:
>Thanks, 
>
>The text below looks much better looks much better. Let's go with that.
>
> >  "The ServerNameList MUST NOT contain more than one name of the same
>>   name_type.  If the server understood the client hello extension,
>>
>>   but does not recognize the server name, the server has two options.
>>   Either abort the handshake sending a fatal unrecognized_name(112)
>>   alert or continue the handshake using a default credential.
>>   Sending a warning-level unrecognized_name(112) alert in the latter
>>   case is NOT RECOMMENDED, since existing client behaviour is
> >   unpredictable.

This is definitely more understandable than earlier revs. However, there is still not enough definitive wording. I propose:

The ServerNameList MUST NOT contain more than one name of the same
name_type.  If the server understood the ClientHello extension but
does not recognize the server name, the server SHOULD take one of two
actions: abort the handshake by sending a fatal
unrecognized_name(112) alert, or continue the handshake using a
default credential. Sending a warning-level alert such as
unrecognized_name(112), but continuing the handshake, is NOT
RECOMMENDED because the client's expected behavior in response to
this is unpredictable.

--Paul Hoffman, Director
--VPN Consortium