Forum Discussion
action_-
Altostratus
AltostratusClient cert auth, more than advertised CA filtering?
We currently use client cert auth using smart cards at my organization. There is a push to move from one CA's certificates to another CA's certificates. There are 3 certificates on each smart card, o...
stan_piron
Cumulonimbus
Cumulonimbusyou Should request the IETF to add such filter in tls specifications...
in tls 1.2, section 7.4.4, the certificate request message structure is the following
struct {
ClientCertificateType certificate_types<1..2^8-1>;
SignatureAndHashAlgorithm
supported_signature_algorithms<2^16-1>;
DistinguishedName certificate_authorities<0..2^16-1>;
} CertificateRequest;
F5 can’t send client more information than described in this message
action_-Thank you for your answer and the reference.
I'll have to report back up the chain that we can't restrict what the server requests for client cert any more granularly than the advertised CA.
