Re:Bug in Lynx's SSL certificate validation – leaks password...
by tialaramex on Saturday August 07, 2021 @03:46PM
(#28101265)
In practice this functionality is rusted in place. If you invented a new name type, that doesn't mean you can call your existing TLS stack's SNI methods with "@Twitter_handle" or "[email protected]" or "#TopicGoesHere" because those methods always write DNS names. There is a type parameter, there has only ever been one type (DNS names) and so that's what your implementation chooses and I haven't ever seen one that lets you change it, because what would you change it to?
Re:Bug in Lynx's SSL certificate validation – leaks password...
by kevin_thibedeau on Saturday August 07, 2021 @04:27PM
(#28101535)
You don't have to invent a new name type.
RFC 5280:
The subject alternative name extension allows identities to be bound to the subject of the certificate. These identities may be included in addition to or in place of the identity in the subject field of the certificate. Defined options include an Internet electronic mail address, a DNS name, an IP address, and a Uniform Resource Identifier (URI). Other options exist, including completely local definitions.
Currently, the only server names supported are DNS hostnames; however, this does not imply any dependency of TLS on DNS, and other name types may be added in the future (by an RFC that updates this document).