FYI: proposal for client authentication in TLS from Martin Thomson on 2014-03-08 (ietf-http-wg@w3.org from January to March 2014)

From: Martin Thomson <martin.thomson@gmail.com>
Date: Sat, 8 Mar 2014 11:39:12 +0000
To: HTTP Working Group <ietf-http-wg@w3.org>
Message-ID: <CABkgnnU1RMHN8sGsRc_KSw3+EutZnrrb-N=WpzP5wuqQ-ECe7Q@mail.gmail.com>

Pursuant to our discussion on TLS renegotiation, I've submitted part 1
of the solution I proposed as an internet draft.

http://datatracker.ietf.org/doc/draft-thomson-tls-care/

If we agree to a mechanism whereby we augment the 401 status code with
a "go away and make a new TLS connection with client authentication",
then this is necessary, so that the server knows to request a client
certificate.

--Martin

Received on Saturday, 8 March 2014 11:39:41 UTC