Re:Opportunistic Security for HTTP
by taralx on Sunday November 02, 2014 @04:23PM
(#8548153)
That's in this spec:
"The server certificate, if one is proffered by the alternative service, is not necessarily checked for validity, expiration, issuance by a trusted certificate authority or matched against the name in the URI."
In other words, the certificate presented is merely used to secure the connection against a passive attacker.
"The server certificate, if one is proffered by the alternative service, is not necessarily checked for validity, expiration, issuance by a trusted certificate authority or matched against the name in the URI."
In other words, the certificate presented is merely used to secure the connection against a passive attacker.