Re: [idn] idn-uri

["Eric A. Hall" <ehall@ehsco.com>]

David Hopwood wrote:

> New SSL/TLS clients can and should use a modified comparison algorithm,
> but the only way to make https: URIs work with old clients is to
> ACE-encode both the name in the URI, and the name in the certificate.

This raises another interesting scenario, which is whether or not the
hostname part should be decoded for certificate comparison, or if the
encoded representation is the only one which can be used until an
extension or negotiation mechansim is made avaialable. EG, if the hostname
is www.zz--example.com then maybe that is the only form which can be used,
since the decoded form of www.example.com will not match the certificate,
unless there is also some way to specify/negotiate the format in use
(like, try it as the encoded form, then try it as the decoded form, then
fail, as one bad example of an approach).

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/