RE: Client script access to server cert info

To clarify, what I'm looking for is a way for script on a page to access the server certificate information used during the SSL connection over which the page was provided. I.e. if Alice requests a page from bob.com, but the bob.com server returns a certificate that actually says mallory.com, and Alice presses "OK" when prompted about the discrepancy, it would be nice if there was a way to detect this using script that ran in the browser. I'm trying to find out if anybody knows of any browser/DOM/DHTML objects that contain a description (signing chain, CN, fingerprint, whatever) of the actual server certificate information presented during the SSL handshake.

Phil

> -----Original Message-----
> From: Brass, Phil (ISS Atlanta)
> Sent: Sunday, April 13, 2003 11:51 PM
> To: webappsec@securityfocus.com
> Subject: Client script access to server cert info
>
>
> Does anybody know if there is a way to access the server
Received on Mon Apr 14 00:24:42 2003