[erlang-questions] TLS: Choosing a server certificate based on client's accepted algorithms
Roger Lipscombe
roger@REDACTED
Wed Jul 12 18:49:51 CEST 2017
Apparently, nginx allows you to specify multiple server certificates
(e.g. RSA and ECDHE), and it'll choose the appropriate one based on
the client's preference.
See, for example:
https://scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx/
I find myself needing something similar. Historically, my server's
used SHA1 certificates, and I want to move to SHA256 certificate, but
I've got embedded clients which are hard to change, so I need to
support both, at least for a while.
Can I persuade OTP to offer a different server certificate depending
on the client?
I can't use (e.g.) SNI, because the client doesn't provide the
server_name extension.
Thanks,
Roger.
More information about the erlang-questions
mailing list