1

Let's assume this (made-up) scenario: I install a webserver that reacts on two hostnames (anonymousserver.com and authenticatedserver.com)

I would like the following behaviour:

  • If the webserver is called by anonymousserver.com, ssl has to be used but no client certificate shall be requested.

  • If the webserver is called by authenticatedserver.com, ssl has to be used and a client certificate shall be requested.

So, is it possible to decide on doing client certificate authentication based on the hostname? The issue I see is that ssl handshake and http get request take place after another; the ssl handshake is already finished when the server knowns which url shall be processed

  • Hi @Marged. Since there seems to be a clear answer, I have distilled out the core question to make it more friendly for future googlers with the same question. If you don't agree with my edit, feel free to edit again, or go into the revision history and do a rollback to your version. – Mike Ounsworth Sep 6 '17 at 17:31
2

A) Decide on doing client certificate authentication based on the hostname

This can be done even if both domains are served on the same IP address as long as the browser sends the target hostname within the SNI TLS extension. All modern browsers do this by default and most but not all apps on recent mobile systems.

B) Decide on doing client certificate authentication based on url

It is not immediately possible since the URL is unknown on initial TLS handshake. It can be done with renegotiation inside an existing TLS handshake.

1

I believe you are looking for the Server Name Indication (SNI) TLS extension. From wikipedia:

Server Name Indication (SNI) is an extension to the TLS computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the [TLS] handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number.

Rather than choosing which certificate to present, you should be able to equally use this mechanism to decide whether or not to ask for client-auth.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.