Subject: Re: [TLS] Encrypting ALPN and other unused extensions

From: Peter Gutmann <[email-masked]>
Date: Sat, 26 Apr 2014 18:30:09 +0000

Paul Hoffman <[email-masked]> writes:

>RFC 6125 says plenty about naming with URIs, as does the base PKIX spec;
>neither specifies any operational way to authenticate past the host name.

While they don't specify how to do it, they also don't say that you can't just
say host:port in the standard manner.  You'd need to update software to handle
this, but at least it's a fail-closed mechanism, if the implementation doesn't
understand host:port then it won't connect.

(Well, it shouldn't connect, given the hit-and-miss nature of hostname
checking it may connect no matter what the string is).

Peter.