Re: server certificate OCSP status inside TLS handshake

2007-11-22 Thread Wan-Teh Chang
On Nov 22, 2007 4:26 AM, Jean-Marc Desperrier <[EMAIL PROTECTED]> wrote: > > So and as WTC said also, OCSP stapling is out for 3.12 > > But what does suprise me is that server side SNI is also out. > > I would have expected that NSS team would have been quite willing to > provide an alternative to

Re: server certificate OCSP status inside TLS handshake

2007-11-22 Thread Jean-Marc Desperrier
Nelson Bolyard wrote: > Jean-Marc Desperrier wrote: >> Jean-Marc Desperrier wrote: >>> [...] >>> I assume this means the client support has been included in NSS. >>> Since which version ? Will this be only for Fx 3, or is it already >>> included in some version of Fx 2 ? >> I should read http://wik

Re: server certificate OCSP status inside TLS handshake

2007-11-21 Thread Nelson Bolyard
Jean-Marc Desperrier wrote: > Jean-Marc Desperrier wrote: >> [...] >> I assume this means the client support has been included in NSS. >> Since which version ? Will this be only for Fx 3, or is it already >> included in some version of Fx 2 ? > > I should read http://wiki.mozilla.org/NSS:Roadmap m

Re: server certificate OCSP status inside TLS handshake

2007-11-20 Thread Wan-Teh Chang
On Nov 19, 2007 2:39 PM, Jean-Marc Desperrier <[EMAIL PROTECTED]> wrote: > Jean-Marc Desperrier wrote: > > [...] > > I assume this means the client support has been included in NSS. > > Since which version ? Will this be only for Fx 3, or is it already > > included in some version of Fx 2 ? > > I s

Re: server certificate OCSP status inside TLS handshake

2007-11-19 Thread Jean-Marc Desperrier
Jean-Marc Desperrier wrote: > [...] > I assume this means the client support has been included in NSS. > Since which version ? Will this be only for Fx 3, or is it already > included in some version of Fx 2 ? I should read http://wiki.mozilla.org/NSS:Roadmap more often. As it's planified in NSS

server certificate OCSP status inside TLS handshake

2007-11-19 Thread Jean-Marc Desperrier
I just found out about MoFO funding OCSP stapling support for mod_ssl : http://issues.apache.org/bugzilla/show_bug.cgi?id=43822 In other words, Apache/mod_ssl web servers will be able to include an OCSP token inside TLS HELLO responses. That will permit the client to validate the server certific