Subject: Re: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Tue, 21 Dec 99 11:47:39 EST

> Jeffrey Altman <[email-masked]> writes:
> 
> > IE 5.0 will refuse to accept this certificate if the specified URL is
> > 
> >   https://18.86.0.96/ 
> > 
> > where the IP address is used instead of the FQDN.
> 
> Netscape will fail to accept the above url, too.  But what happens
> if you add 'mit.edu' to your DNS search list and then you try:
> 
> 	https://ted-williams
> 
> ???
> 
> -derek

Netscape puts up a dialog asking me to accept the unknown CA.

The IE behavior (win2000) is a little stranger.  It appears to accept
the certificate and reports that the host wants be to transmit a
certificate to authenticate myself.  When I fail to specify a local
cert it responds with

  Cannot find server or DNS error

Which appears to indicate that it is continuing to look down the DNS
Search List for additional servers to try.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Derek Atkins <[email-masked]>
Date: 21 Dec 1999 12:30:15 -0500

> Search List for additional servers to try.

Well, the server shouldn't accept you without a valid certificate
anyways...  But besides that, it sounds like it will let you through.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]