Subject: [hybi] TLS-NPN - was Re: Why not just use ssh?

From: John Tamplin <[email-masked]>
Date: Wed, 1 Sep 2010 12:02:29 -0400

While we are on the topic of TLS-NPN, I looked briefly and I wasn't
sure but it looks like the choice of which certificate to present to
the client happens before the WebSocket protocol is involved -- is
that correct?

If so, that would seem to preclude having "virtual domain" support for
WebSocket servers over TLS.  While that hasn't proven insurmountable
with https, it seems like it would be a good thing if we avoid this
limitation with WebSockets.

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: "Brian Smith" <[email-masked]>
Date: Wed, 1 Sep 2010 11:14:02 -0500

John Tamplin wrote:
> While we are on the topic of TLS-NPN, I looked briefly and I wasn't sure
but it
> looks like the choice of which certificate to present to the client
happens before
> the WebSocket protocol is involved -- is that correct?
> 
> WebSocket servers over TLS.  While that hasn't proven insurmountable with
> https, it seems like it would be a good thing if we avoid this limitation
with
> WebSockets.

This issue and similar issues were already discussed on the [email-masked]
list. The TLS SNI (server name indication) extension would handle this. The
SNI extension would get processed before (or maybe concurrently with) the
NPN extension. 

Regards,
Brian

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 1 Sep 2010 09:19:20 -0700

Sort of.

You can use server name indication for cert selection, but you would need to
use the same cert for WS and HTTPS unless they had different hostnames.
I agree that this should be improved.

-Ekr

---

From: Ian Fette (イアンフェッティ) <[email-masked]>
Date: Wed, 1 Sep 2010 10:16:49 -0700

I don't know how important that is. I mean, if it's going to the same port
and handled by the same webserver initially, as the upgrade is HTTP first
that then does an "UPGRADE", I don't know why would need to use two
different certs. To me, SNI seems like it ought to be sufficient.

-Ian

On Wed, Sep 1, 2010 at 9:19 AM, Eric Rescorla <[email-masked]> wrote:

> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>
>

---

From: Roberto Peon <[email-masked]>
Date: Wed, 1 Sep 2010 10:56:22 -0700

SNI isn't deployed everywhere yet on the browser side-- It seems we'll have
to wait a long time before the tail of people unable to use SNI drops to
something tolerable.

In any case, the problems that WS has here are the same ones faced by HTTPS.
Nothing to see here. :)
-=R

---

From: Ian Fette (イアンフェッティ) <[email-masked]>
Date: Wed, 1 Sep 2010 11:05:03 -0700

Sure. But I would be surprised to see a browser that supports WebSockets but
not SNI, so it seemed a bit tangential. E.g. creating a new solution for WS
separate from SNI doesn't seem like it will make the solution any more
palatable / widely adopted than SNI.

-Ian

2010/9/1 Roberto Peon <[email-masked]>

> In any case, the problems that WS has here are the same ones faced by
> HTTPS. Nothing to see here. :)
> -=R
>
>

---

From: Adam Barth <[email-masked]>
Date: Wed, 1 Sep 2010 11:39:40 -0700

> palatable / widely adopted than SNI.

In fact, SNI is required by the current draft.

Adam