search

davidben / merkle-tree-certs

Other
9 stars 2 forks source link

[duplicate] Client certificates #40

Closed bwesterb closed 1 year ago

bwesterb commented 1 year ago

This section defines the Bikeshed TLS certificate type, which may be negotiated with the client_certificate_type, server_certificate_type {{!RFC7250}}, or cert_type {{!RFC6091}} extensions. It can only be negotiated with TLS 1.3 or later. Servers MUST NOT negotiate it in TLS 1.2 or below. If the client receives a ServerHello that negotiates it in TLS 1.2 or below, it MUST abort the connection with an illegal_parameter alert.

[[TODO: None of these three extensions is quite right for client certificates because the negotiation isn't symmetric. See discussion in {{cert-type-problems}}. We may need to define a third one.]]

bwesterb commented 1 year ago

Duplicate of #18