safe renegotiation

Nikos Mavrogiannopoulos nmav at
Tue May 18 21:34:41 CEST 2010

Simon Josefsson wrote:

>> If people notice that no clients can connect on their servers will
>> either install an older version of gnutls that "works" or just go to
>> mod_ssl. Moreover it is problematic in the sense that an administrator
>> might not detect at all that his site is inaccessible and only find
>> out after losing customers or so. I think that fixing a security issue
>> but as a side-effect causing serious issues in interoperability with
>> old software is a recipe for people to move out of your software
>> (intel never managed to get rid of x86, and I don't think we can
>> afford it).
>> Let's be conservative and wait. This issue proved not to be that
>> important in the internet (not many people upgraded because of this).
> According to Tomas, OpenSSL protect against this.  If that is the case,
> I think the answer is simple: we should do the same.

I've commited a patch that does that in git.


More information about the Gnutls-devel mailing list