On 23 Dec 2016 5:04 AM, "Richard Bradbury" <richard.bradbury@rd.bbc.co.uk> wrote: Hmm... The statement in the above quotation seems inconclusive to me. Surely a client could verify the server's identity simply by checking that the target authority appears in the server's certificate (and that the certificate is valid too, of course...). Wouldn't that satisfy the security consideration on establishing authority described in section 9.1? Yes[1], if the cert is good and the name is right, that is enough. Except... We still require that the IP address matches. But only for coalescing: > For TCP connections without TLS, this depends on the host having resolved to the same IP address. > > For https resources, connection reuse additionally depends on having a certificate that is valid for the host in the URI. It seems like the requirements for the initial connection are the only ones that are ambiguous :) ah the joys of dealing with specs. Maybe I need to do a writeup. That isn't going to happen soon though. Keep up the good work, and maybe you can write this up. [1] The part that you might have been missing is how the valid certificate is linked to a trust anchor. That is where is gets much, much more complicated. (You might have meant to include that by saying "valid", but I wanted to be explicit.)
Received on Thursday, 22 December 2016 22:31:16 UTC