From what I understand about SSL authentication, the FQDN of the party I trust has to match the common name or one of the subject alternate names. Does this apply for client certificates as well? So what happens for a client authentication scenario when clients don't have a fixed IP address or domain name?
1 Answer
It's always up to the authenticating party to decide what checks to perform on the far side's credentials, and what's satisfactory. So we see that web browsers (HTTPS) can get quite tetchy about merely out-of-date certificates, but mail servers (SMTP STARTTLS) by and large don't care who signs the certificates they accept.
That makes it very hard to give a precise answer to your question. But generally, the server will expect to see a client certificate signed by a specifically-designated CA root. As long as it sees the right signature on the certificate, the embedded details are of comparitively little import.
answered Sep 16, 2015 at 12:31
