enforcing mutual auth from the client
stephen.wall at redcom.com
Fri Sep 2 00:22:35 UTC 2022
> A compromised server could easily still request the client certificate, no?
> But as noted, even a compromised server can ask for client credentials and then
Yes, that's true. If the intruder knew to do so. Also, a thief can break your window and get into your car, so you might as well leave them rolled down all the time.
The question wasn't "Should I care that..." or "Is it a good idea to...". It was "Can OpenSSL 3 do this".
More information about the openssl-users