Re: [xmpp] Clarification of TLS Identity checking in draft-ietf-xmpp-3920bis

[Joe Hildebrand <[e-mail]>]

On 3/14/11 4:38 PM, "Florian Zeitz" <[e-mail]> wrote:


> I was recently wondering something related.
> Do I set the 'to' attribute in the initial stream header to the JID's
> domainpart, or to the domain I got from a SRV lookup?
> The later is certainly not sufficient as a source domain. That in turn
> implies (IMHO) we will always have/want to set the 'to' attribute to the
> JID's domainpart (and while the draft actually says to put a
> "domainpart" there, it is not specific on where to get that from,
> especially for the cases where you can't set a 'from', because you don't
> know the JID beforehand). I'd therefore assume you'd not use the
> user-entered FQDN as source domain, but I'd like some clarification on
> that point, too.

It's always the domain name the user entered, not something you get from the
(currently untrusted) DNS.  Many servers use this name to figure out which
certificate to give you when you Start-TLS, rather than having to rely on
SNI.

-- 
Joe Hildebrand