>> It's a off-the-shelf browser connecting to my SSL-protected service
>> which masquerades as a Web server. I don't get to make decisions
>> about what the client will or will not do.
>
> You didn't tell if it's the hostname or the domain that keeps
> changing. If it's the hostname, like I said before it makes sense to
> buy a wildcard cert anyways. If it's the domain (or even if it's the
> host) why don't you set up a HTTP front that the client must go
> thru before hitting the HTTPS side. Now the HTTP header is going to
> tell you what the host that the client is trying to connect to is
> (that's what you're ultimately interested in, not what you think your
> host/domain is). Now you can associate the client's ip address with
> the host he/she is trying to connect to. On the SSL side you can then
> consult the map and present a cert that matches with the requested
> hostname.
Forgot to add, you can also buy a certificate with dozens of host names in
it and they don't have to be in the same domain either. I.e. you could
have www.a.com in the CN field and then www.b.net in the subject alt name
field.
If you're self-signing the certificates, even better, just create a cert
with *.*.* as the host and the client browser will accept it just fine (as
long as your root is in their trust store, of course).
--
Marko Hantula
DB Solo - The SQL Query Tool
www.dbsolo.com
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Java-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/java-dev/email@hidden
This email sent to email@hidden
