Re: New Version Notification for draft-nottingham-http2-encryption-02.txt

On Wed, Dec 11, 2013 at 8:52 PM, Mark Nottingham <mnot@mnot.net> wrote:

>
> One possible use is that the server may want/need to know whether or not
> the client is validating the cert; e.g., a bank.
>
>
1) In what scenarios that are similar to what we have today does a server
want/need to know that the client validated the cert? In your "a bank"
example, assume that the user removed the WhizzyCA root from the browser's
pile, the bank chains up to WhizzyCA, and the user clicked through the "do
you really want to do this" warning from his browser. How does that server
know that?

2) Are there other possible uses?

--Paul Hoffman