Aslam <[EMAIL PROTECTED]> writes:
> I have a general question about :
>
> If while in ssl/tls handshake, one encounters an error, whether to send
> alert that time only or let the handshake get complete and then send an
> alert to the peer for closing the session..
>
> Consider server authentication fails on client side, then should client send
> an alert right now or waits for the handshake to get complete and later send
> a alert "close notify"..
>
> In Openssl, it send the alert at the moment it gets an error like
> certificate verification failed, but Microsoft Secured Channel continues to
> do handshake and it the application responsibility to send a close notify
> alert..
What you're seeing here is the difference between an error being
handled by the toolkit (OpenSSL) and being handled by the application
(SChannel). In general, it makes more sense to handle the error
at the time it is detected. This saves time on both sides and gives
the server a better idea of what happened.
Don't think of the close_notify as an error. It's not. It's simply
what happens when you close an SSL connection properly.
-Ekr
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
