Add certificate serial number (sn) to mDNS TXT record requirements #360
Conversation
This fixes a specification bug where the hostname formation requires the certificate serial number, but it was not being advertised in mDNS TXT records, making it impossible for clients to form the correct hostname for TLS SNI. Resolves the discrepancy between hostname formation requirements and mDNS advertisement specifications.
| `[A-Za-z0-9+/]`. | ||
|
|
||
| : sn | ||
| :: The [=certificate serial number=] of the advertising agent, encoded as a |
There was a problem hiding this comment.
Why is the agent fingerprint insufficent for computing the agent hostname? I also don't see any other reference to TLS SNI in this file, and it's not entirely clear to me why we even need Server Name Indication for this protocol. Can you please provide some additional context?
There was a problem hiding this comment.
Been a while, from what I remember:
The serial number was introduced to solve #276. It is used as part of the subject name on the certificate. To keep connection logic as common as possible, I was also checking the subject name against the host being dialed. For the first-time dial I guess this could be seen as a bit if useless ceremony. For re-establishing a connection with a known (previous authenticated) certificate this does seems useful.
Regarding SNI: In a real browser setting I can imagine that you may want to use different connections per origin at some point (to ensure appropriate segregation). A different hostname is one way to represent that at the network level. SNI would allow doing this on one port. Also, it again keeps the use of TLS close to what is commonly done (which I think is an advantage because you can more easily use existing implementations).
This fixes a specification bug where the hostname formation requires the certificate serial number, but it was not being advertised in mDNS TXT records, making it impossible for clients to form the correct hostname for TLS SNI.
Resolves the discrepancy between hostname formation requirements and mDNS advertisement specifications.