Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <4929E264.3010509@iang.org>
Date: Sun, 23 Nov 2008 18:08:20 -0500
From: Ian G <iang@iang.org>
User-Agent: Thunderbird 2.0.0.18 (Macintosh/20081105)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Re: Name based virtual host ssl clever solution
References: <1227444490.5622.ezmlm@httpd.apache.org>
In-Reply-To: <1227444490.5622.ezmlm@httpd.apache.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit


> I'm not sure if any browser available currently support this, but I
> suppose none. Maybe if it became RFC, you might get Mozilla folks
> interested with this :)

As far as I know, Mozilla guys are hanging out for TLS/SNI, as is the 
rest of the world.  They and the other browsers have been ready for 
ages.   There was a big push around 2005-2006 to get over to full TLS 
because of SSLv2 bug and the emergence of phishing as an MITM.

TLS/SNI is the "real fix" for the bug, whereas other tricks (and there 
are quite a few of them) are all suspect for one reason or another; 
when you try them you discover what goes wrong.  There's a list of 
possibilities here:

http://wiki.cacert.org/wiki/VhostTaskForce
http://en.wikipedia.org/wiki/Server_Name_Indication

TLS/SNI is working in Apache httpd, and has been for a while, but is 
unreleased.  I don't know or understand the reason for that.


iang