5 ms·
> it needs to know which TLS cert to use prior to handing over control of the connection It is a bit unclear here what that means. I mean TLS has a mechanism t
by hannob 4y ago
> it needs to know which TLS cert to use prior to handing over control of the connection
It is a bit unclear here what that means. I mean TLS has a mechanism to choose the certificate based on the hostname (SNI). Other than that - why would a different user get a different certificate? After all the certificate's job is to identify the server.
- billpg 4y agoThat's a flaw in dot-net's SslStream library. You don't get an opportunity to know what host the client is expecting before selecting the cert for this session. Reading discussions around this issue usually settle on reading and parsing the "ClientHello" to extract the SNI name, and then hacking the ClientHello back into the incoming stream so TLS code can read it.