51405 - SSL should ignore bad user certs if certs not required

Status: ASSIGNED

(NSS :: Libraries, enhancement, P3)

Description

[Nelson Bolyard (seldom reads bugmail)]

This was formerly bugsplat bug 114568

On 1998-4-21, [e-mail] wrote:

If a server sets REQUEST_CERT, but does not set REQUIRE_CERT, then any cert the 
client sends which is unacceptable for some reason (expired, untrusted CA chain) 
should simply be ignored.  The handshake should complete, and 
SSL_PeerCertificate() should return NULL.

It would be nice if the server could get a callback telling it why the cert was 
unacceptable, but this second feature is a P2 or P3.

This behavior can be acheived with the NSS cert callbacks today, but is
still worth considering for the next "major" release, when we can change
the API.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Change target fix version for all "stan" RFEs to "Future".

Comment 2

[Thomas]

Is there a way people can test if this behaviour is still current?

Comment 3

[Julien Pierre]

Thomas,

Yes, there is, if you setup the NSS tests, create a set of certs to reproduce
the condition, and run the test server, selfserv . I doubt very much that this
has been fixed, though, because of the lack of update to this bug.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

This enhancement does not depend on Stan in any way.