<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I opened the bug. As this feature does not apply to HTTP/2, it may be not enabled by default. But please stay tuned for what it may look like.<div class=""><br class=""></div><div class="">Xuelei<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Aug 10, 2022, at 9:04 AM, Brad Wood <<a href="mailto:bdw429s@gmail.com" class="">bdw429s@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The future of HTTP is my concern here<br clear="all" class=""></blockquote><div class=""><br class=""></div><div class="">I get that, but my current client requirements is my concern here :) Let's not throw the baby out with the bathwater because of what may come. If there is a post-handshake client verification that works via TLSv1.3 over HTTP/1, let's not prevent people from using that today (taking into account Browser support, of course). Once the HTTP/2 spec has been ironed out (which I know can take years) then java can cross that bridge when it comes to it.</div><div class=""> </div><div class=""><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">~Brad</div><div class=""><br class=""></div><div class=""><b class="">Developer Advocate</b></div><div class=""><i class="">Ortus Solutions, Corp </i></div><div class=""><b class=""><br class=""></b></div><div class="">E-mail: <a href="mailto:brad@coldbox.org" target="_blank" class="">brad@coldbox.org</a></div><div class="">ColdBox Platform: <a href="http://www.coldbox.org/" target="_blank" class="">http://www.coldbox.org</a> </div><div class="">Blog: <a href="http://www.codersrevolution.com/" target="_blank" class="">http://www.codersrevolution.com</a></div><div class=""><br class=""></div></div></div></div></div></div><br class=""></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Aug 10, 2022 at 9:36 AM Xuelei Fan <<a href="mailto:xuelei.f@gmail.com" class="">xuelei.f@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="overflow-wrap: break-word;" class=""><br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Aug 10, 2022, at 6:49 AM, Brad Wood <<a href="mailto:bdw429s@gmail.com" target="_blank" class="">bdw429s@gmail.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" class="">Honestly, what does HTTP/2 have to do with the ticket in question?</div></div></blockquote><div class=""><br class=""></div><div class="">The future of HTTP is my concern here. Thank you for sharing the link (draft RFC) bellow.</div><div class=""><br class=""></div><div class="">Xuelei</div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""> TLS 1.3 supports a post-handshake method of requesting client certs without renegotiating the entire SSL handshake. Java needs to support this. <div class=""><br class=""></div><div class="">From my research, any other web server such as Nginx simply requires that HTTP/1 be used when this feature is needed. I suggest we do the same. If you are concerned about the future of HTP/2, I would direct you to some proposed updates to the HTTP/2 which will accommodate post handshake client cert requests: <a href="https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-http2-secondary-certs" target="_blank" class="">https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-http2-secondary-certs</a> In the mean time, I have no issues using HTTP/1 for the specific apps that require this. </div><div class=""><br clear="all" class=""><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">~Brad</div><div class=""><br class=""></div><div class=""><b class="">Developer Advocate</b></div><div class=""><i class="">Ortus Solutions, Corp </i></div><div class=""><b class=""><br class=""></b></div><div class="">E-mail: <a href="mailto:brad@coldbox.org" target="_blank" class="">brad@coldbox.org</a></div><div class="">ColdBox Platform: <a href="http://www.coldbox.org/" target="_blank" class="">http://www.coldbox.org</a> </div><div class="">Blog: <a href="http://www.codersrevolution.com/" target="_blank" class="">http://www.codersrevolution.com</a></div><div class=""><br class=""></div></div></div></div></div></div><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Aug 9, 2022 at 9:05 PM Xuelei Fan <<a href="mailto:xuelei.f@gmail.com" target="_blank" class="">xuelei.f@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="">If we have a look from the viewpoint of HTTP/2, how applications could meet the requirements in HTTP/2? Did you have a plan to have the application works with HTTP/2 in the future? <div class=""><br class=""></div><div class="">Xuelei<br class=""><div class=""><br class=""><blockquote type="cite" class=""><div class="">On Aug 9, 2022, at 12:29 PM, Brad Wood <<a href="mailto:bdw429s@gmail.com" target="_blank" class="">bdw429s@gmail.com</a>> wrote:</div><br class=""><div class=""><div dir="ltr" class="">I have some questions about this ticket<div class=""><a href="https://bugs.openjdk.org/browse/JDK-8206923" target="_blank" class="">https://bugs.openjdk.org/browse/JDK-8206923</a></div><div class="">which was closed as "won't fix". I fully realize that TLS 1.3 forbids SSL renegotiation after the handshake in the traditional manner, but I'm curious if the process defined here can be used instead:</div><div class=""><a href="https://www.openssl.org/docs/manmaster/man3/SSL_verify_client_post_handshake.html" target="_blank" class="">https://www.openssl.org/docs/manmaster/man3/SSL_verify_client_post_handshake.html<br clear="all" class=""></a><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><div dir="ltr" class=""><div class=""></div><div class=""><br class=""></div><div class="">I'm new to this, but it appears to be describing how to accomplish post-handshake client verification which works on TLS 1.3. </div><div class=""><br class=""></div><div class="">There's not a lot of information online, but this ticket appears to be Python adding support for this:</div><div class=""><a href="https://bugs.python.org/issue34670" target="_blank" class="">https://bugs.python.org/issue34670</a><br class=""></div><div class=""><br class=""></div><div class="">Can we discuss reopening the openjdk ticket if this is actually possible? The use case for this is a rather common requirement-- to have an SSL site which doesn't prompt the user for a client cert until they visit a secured area, and then the client cert request is sent, prompting the user at that point. </div><div class="">Currently, I have to disable both HTTP/2 and TLS 1.3 in order for this to work. I don't mind sticking to HTTP/1. but I have concerns about disabling TLSv1.3 and what that means for the future security of my apps.</div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""><br class=""></div><div class="">~Brad</div><div class=""><br class=""></div><div class=""><b class="">Developer Advocate</b></div><div class=""><i class="">Ortus Solutions, Corp </i></div><div class=""><b class=""><br class=""></b></div><div class="">E-mail: <a href="mailto:brad@coldbox.org" target="_blank" class="">brad@coldbox.org</a></div><div class="">ColdBox Platform: <a href="http://www.coldbox.org/" target="_blank" class="">http://www.coldbox.org</a> </div><div class="">Blog: <a href="http://www.codersrevolution.com/" target="_blank" class="">http://www.codersrevolution.com</a></div><div class=""><br class=""></div></div></div></div></div></div></div>
</div></blockquote></div><br class=""></div></div></blockquote></div>
</div></blockquote></div><br class=""></div></blockquote></div>
</div></blockquote></div><br class=""></div></body></html>