{"action":"created","issue":{"url":"https://api.github.com/repos/yesodweb/wai/issues/430","labels_url":"https://api.github.com/repos/yesodweb/wai/issues/430/labels{/name}","comments_url":"https://api.github.com/repos/yesodweb/wai/issues/430/comments","events_url":"https://api.github.com/repos/yesodweb/wai/issues/430/events","html_url":"https://github.com/yesodweb/wai/issues/430","id":105974862,"number":430,"title":"Post-request TLS renegotiation for client certs","user":{"login":"DaveCTurner","id":5058284,"avatar_url":"https://avatars.githubusercontent.com/u/5058284?v=3","gravatar_id":"","url":"https://api.github.com/users/DaveCTurner","html_url":"https://github.com/DaveCTurner","followers_url":"https://api.github.com/users/DaveCTurner/followers","following_url":"https://api.github.com/users/DaveCTurner/following{/other_user}","gists_url":"https://api.github.com/users/DaveCTurner/gists{/gist_id}","starred_url":"https://api.github.com/users/DaveCTurner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DaveCTurner/subscriptions","organizations_url":"https://api.github.com/users/DaveCTurner/orgs","repos_url":"https://api.github.com/users/DaveCTurner/repos","events_url":"https://api.github.com/users/DaveCTurner/events{/privacy}","received_events_url":"https://api.github.com/users/DaveCTurner/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-09-11T09:23:21Z","updated_at":"2015-09-15T06:41:18Z","closed_at":null,"body":"Hi,\r\n\r\nI'm in the process of debugging a non-Haskell HTTPS issue and have come across a protocol flow that I was previously unaware of. When using client certificates to authenticate to IIS, the initial connection is set up without client certificates (the server sends no `CertificateRequest` message) and then once the request is received the connection is renegotiated. This means that it can decide whether or not to request a client cert (and even decide which certs to request) on a per-request basis rather than just when the connection is opened.\r\n\r\nThis is definitely not possible with the current `wai` API. As far as I can tell it's also not supported in Nginx or Apache either: in both cases, the client cert verification config applies to the whole server/vhost and the cert exchange occurs when the connection is being established. So this is a fairly speculative nice-to-have, but I thought it was worth raising anyway.\r\n\r\nCheers,\r\n\r\nDavid"},"comment":{"url":"https://api.github.com/repos/yesodweb/wai/issues/comments/140295722","html_url":"https://github.com/yesodweb/wai/issues/430#issuecomment-140295722","issue_url":"https://api.github.com/repos/yesodweb/wai/issues/430","id":140295722,"user":{"login":"DaveCTurner","id":5058284,"avatar_url":"https://avatars.githubusercontent.com/u/5058284?v=3","gravatar_id":"","url":"https://api.github.com/users/DaveCTurner","html_url":"https://github.com/DaveCTurner","followers_url":"https://api.github.com/users/DaveCTurner/followers","following_url":"https://api.github.com/users/DaveCTurner/following{/other_user}","gists_url":"https://api.github.com/users/DaveCTurner/gists{/gist_id}","starred_url":"https://api.github.com/users/DaveCTurner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DaveCTurner/subscriptions","organizations_url":"https://api.github.com/users/DaveCTurner/orgs","repos_url":"https://api.github.com/users/DaveCTurner/repos","events_url":"https://api.github.com/users/DaveCTurner/events{/privacy}","received_events_url":"https://api.github.com/users/DaveCTurner/received_events","type":"User","site_admin":false},"created_at":"2015-09-15T06:41:18Z","updated_at":"2015-09-15T06:41:18Z","body":"Now that is a good question!\r\n\r\nMy first thought is to add a field to Request of (moral) type ExtraAuthRequest -> IO ExtraAuthResponse.\r\n\r\nI imagine, although have not checked, that TLS allows you to do this renegotiation (a) multiple times and (b) even after the response has been partially sent. If so, a function of that type is all that's needed."}}