[gnutls-devel] Mandatory to honor DN in server certificate requests?

[Martin Storsjö]

On Thu, 28 Apr 2016, Martin Storsjö wrote:

> On Thu, 28 Apr 2016, Nikos Mavrogiannopoulos wrote:
>
>> On Wed, Apr 27, 2016 at 10:41 AM, Martin Storsjö <martin at martin.st> wrote:
>> 
>> It is not the TLS protocol which will specify that behavior but rather
>> the application protocol. gnutls takes the conservative approach and
>> does not reveal the ID of the client if it doesn't match the expected
>> ID from the server. That way if you mistakenly specified your
>> certificate from site A your ID will not be revealed just because site
>> B asked of a certificate as well.
>
> Ok, that sounds sensible.
>
>>> Is firefox at fault here (sending unrelated CAs as part of this handshake 
>>> -
>>> e.g. chrome doesn't send any such), or does gnutls need an option for
>>> intentionally ignoring the requested CAs and sending whatever certificate 
>>> is
>>> provided, letting the server decide whether it is acceptable?
>> 
>> If the server would accept a certificate not signed by anyone in his
>> accepted list, why not send an empty list instead?
>
> Fair enough - I guess it sounds like I should file a bug with firefox then.

For the record, newer firefox versions (at least 48) seem to have fixed 
this issue as well, so no bug report was filed on my behalf.

// Martin