enforcing mutual auth from the client

Wall, Stephen stephen.wall at redcom.com
Fri Sep 2 00:22:35 UTC 2022

> A compromised server could easily still request the client certificate, no?

> But as noted, even a compromised server can ask for client credentials and then

Yes, that's true.  If the intruder knew to do so.  Also, a thief can break your window and get into your car, so you might as well leave them rolled down all the time.

The question wasn't "Should I care that..."  or "Is it a good idea to...".  It was "Can OpenSSL 3 do this".


More information about the openssl-users mailing list