Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Unfortunately, that's not valid per the RFCs (from rfc 5246, TLS 1.2):

"certificate_list

      This is a sequence (chain) of certificates.  The sender's
      certificate MUST come first in the list.  Each following
      certificate MUST directly certify the one preceding it.  Because
      certificate validation requires that root keys be distributed
      independently, the self-signed certificate that specifies the root
      certificate authority MAY be omitted from the chain, under the
      assumption that the remote end must already possess it in order to
      validate it in any case."
I would be super happy if I could send multiple certificates though (provided all my clients magically got tls client library updates to handle it)


Just edited my comment.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: