Re: Sendmail TLS with multiple virtual domains
- From: Kari Hurtta <hurtta@xxxxxxxxxxxxxxxxx>
- Date: 20 May 2006 12:35:55 +0300
"D. Stussy" <att-spam@xxxxxxxxxxxxxxxx> writes:
On Wed, 17 May 2006, Per Hedeland wrote:
In article <1147897705.628275.8920@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> "Big
Negrow" <big.negrow@xxxxxxxxx> writes:
Unless there is something within Sendmail I am unaware of, it can only
be responsible for a single certificate to represent it's hostname.
It's impossible for any MTA to have multiple certificates without using
multiple IP addresses - the server has no way of knowing which host name
the client looked up to make the connection, so can't know which
certificate to present. I guess this could be considered a bug in the
SMTP STARTTLS spec - since the parties *do* communicate before the
establishment of the TLS session, there would have been an opportunity
for the client to inform the server about the host name (e.g. as an
argument to the STARTTLS command). But I assume that if this was
considered at all, it was deemed pointless - as you wrote in your
previous message, it shouldn't matter which host name is used for SMTP.
That's a bug? The same thing happens with web servers and HTTPS. One cannot
virtual host without having a separate IP address for each SSL-ed inbound
connection of the same port type. However, the best parallel would be if the
TCP connection came in via SMTPS, not SMTP - for I agree that connecting via
SMTP then issuing a STARTTLS command with the identity of the destination
virtual server (if it were allowed) COULD have avoided this issue.
https is _not_ same thing
smtp + starttls on smtp word
correspond
http + Upgrade: TLS on WWW -word
( See http://www.ietf.org/rfc/rfc2817.txt )
That later either do not require every virtual host to be
own ip address although TLS is used.
( On Upgrade: TLS you can send Host: -header on clear text
part before TLS is started. )
/ Kari Hurtta
.
- References:
- Sendmail TLS with multiple virtual domains
- From: ubralod
- Re: Sendmail TLS with multiple virtual domains
- From: Big Negrow
- Re: Sendmail TLS with multiple virtual domains
- From: ubralod
- Re: Sendmail TLS with multiple virtual domains
- From: Big Negrow
- Re: Sendmail TLS with multiple virtual domains
- From: Per Hedeland
- Sendmail TLS with multiple virtual domains
- Prev by Date: Re: Backscatter solution
- Next by Date: Re: Sendmail TLS with multiple virtual domains
- Previous by thread: Re: Sendmail TLS with multiple virtual domains
- Next by thread: Re: Sendmail TLS with multiple virtual domains
- Index(es):
Relevant Pages
|
