$Sock Cert Info - Revision history

JAL: add 7.7 maximum length

2016-08-29T22:31:21Z

add 7.7 maximum length

← Older revision		Revision as of 22:31, 29 August 2016
Line 26:		Line 26:

	This argument is optional; the default value is 1.		This argument is optional; the default value is 1.
	For more information about certificate levels, see ~~the <i>~~[~~http://www.sirius-software.com/maint/download/jansslr.pdf~~ Janus Network Security ~~Reference Manual~~]</i>.</td></tr>		For more information about certificate levels, see [[Janus Network Security]]</i>.</td></tr>
	</table>		</table>

Line 76:		Line 76:

	<tr><th><var>TEMPORARYKEYLENGTH</var></th>		<tr><th><var>TEMPORARYKEYLENGTH</var></th>
	<td>The length of the temporary or "ephemeral" private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>TEMPORARYKEYLENGTH</var> always returns a 0		<td>The length of the temporary or "ephemeral" private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>TEMPORARYKEYLENGTH</var> always returns a 0 (<var>$Sock_Cert_Info</var>) or Socket object method (<var>[[CertInfo (Socket function)\|CertInfo]]</var>).
	(<var>$Sock_Cert_Info</var>) or Socket object method (<var>[[CertInfo (Socket function)\|CertInfo]]</var>).
	<p>		<p>
	<var>TEMPORARYKEYLENGTH</var> can be abbreviated <var>TEMPORARYKEYL</var>, <var>TEMPKEYLENGTH</var> or <var>TEMPKEYL</var>. </p></td></tr>		<var>TEMPORARYKEYLENGTH</var> can be abbreviated <var>TEMPORARYKEYL</var>, <var>TEMPKEYLENGTH</var> or <var>TEMPKEYL</var>. </p></td></tr>

JAL: add 7.7 maximum length

2016-08-29T22:22:21Z

add 7.7 maximum length

← Older revision		Revision as of 22:22, 29 August 2016
Line 69:		Line 69:

	<tr><th><var>PRIVATEKEYLENGTH</var></th>		<tr><th><var>PRIVATEKEYLENGTH</var></th>
	<td>The length of the private key used by the signer or the client. Private key lengths are usually expressed in terms of number of bits, so <var>PRIVATEKEYLENGTH</var> returns a decimal number string, such as "~~512~~" or "~~1024~~".		<td>The length of the private key used by the signer or the client. Private key lengths are usually expressed in terms of number of bits, so <var>PRIVATEKEYLENGTH</var> returns a decimal number string, such as "1024" or "2048".
	<p>		<p>
	This value could be used to determine a "level of trustworthiness" of a client certificate, where a ~~512~~-bit certificate is considered somewhat weak (though probably strong enough for all but the most extreme security requirements), and a ~~1024~~-bit certificate is considered strong. <var class="product">Janus Network Security</var> will not accept certificates that indicate private keys shorter than 512 bits or longer than 2048 ~~bits~~. Generally, client certificates use ~~either~~ a ~~512~~-bit or a ~~1024~~-bit key. </p>		This value could be used to determine a "level of trustworthiness" of a client certificate, where a 1024-bit certificate is considered somewhat weak (though probably strong enough for all but the most extreme security requirements), and a 2048-bit certificate is considered strong. <var class="product">Janus Network Security</var> will not accept certificates that indicate private keys shorter than 512 bits or longer than 4096 (as of version 7.7 of Model 204; formerly, 2048). Generally, client certificates use a 1024-bit or a 2048-bit key. </p>
	<p>		<p>
	<var>PRIVATEKEYLENGTH</var> can be abbreviated <var>PRIVATEKEYL</var>, <var>PKEYLENGTH</var>, or <var>PKEYL</var>. </p></td></tr>		<var>PRIVATEKEYLENGTH</var> can be abbreviated <var>PRIVATEKEYL</var>, <var>PKEYLENGTH</var>, or <var>PKEYL</var>. </p></td></tr>

JAL: link repair

2016-05-25T19:12:46Z

link repair

← Older revision		Revision as of 19:12, 25 May 2016
Line 1:		Line 1:
	{{DISPLAYTITLE:$Sock_Cert_Info}}		{{DISPLAYTITLE:$Sock_Cert_Info}}
	<span class="pageSubtitle">Value of entity in partner's certificate</span>		<span class="pageSubtitle">Value of entity in partner's certificate</span>
	<p class="warn"><b>Note: </b>Most ~~Sirius~~ $functions have been deprecated in favor of Object Oriented		<p class="warn"><b>Note: </b>Most $functions have been deprecated in favor of Object Oriented
	methods. The OO equivalent for <var>$Sock_Cert_Info</var> is the <var>[[CertInfo (Socket function)\|CertInfo]]</var> method. </p>		methods. The OO equivalent for <var>$Sock_Cert_Info</var> is the <var>[[CertInfo (Socket function)\|CertInfo]]</var> method. </p>

Line 11:		Line 11:

	===Syntax terms===		===Syntax terms===
	<table ~~class="syntaxTable"~~>		<table>
	<tr><th>%string</th>		<tr><th>%string</th>
	<td>The value of the requested entity at the requested level of the certificate supplied by the remote partner.		<td>The value of the requested entity at the requested level of the certificate supplied by the remote partner.
	If no such certificate was provided, the null string is returned.</td></tr>		If no such certificate was provided, the null string is returned.</td></tr>
	<tr><th>socket</th>
	<td>A string that is the socket identifier.</td></tr>		<tr><th>socket</th>
	<tr><th>entity</th>		<td>A string that is the socket identifier. </td></tr>
			<tr><th>entity</th>

	<td>The name of the requested entity. Valid values are described [[#Certificate entities\|below]]. </td></tr>		<td>The name of the requested entity. Valid values are described [[#Certificate entities\|below]]. </td></tr>
	<tr><th>level</th>
			<tr><th>level</th>
	<td>The certificate level at which to obtain the entity: Level 0 corresponds to the client or the "subject" of the certificate; level 1 corresponds to the "signer" of the certificate; level 2 corresponds to the "signer" of the level 1 signer's certificate; and so on.		<td>The certificate level at which to obtain the entity: Level 0 corresponds to the client or the "subject" of the certificate; level 1 corresponds to the "signer" of the certificate; level 2 corresponds to the "signer" of the level 1 signer's certificate; and so on.

Line 28:		Line 31:
	===Certificate entities===		===Certificate entities===
	The following entities can be requested with <var>$Sock_Cert_Info</var>:		The following entities can be requested with <var>$Sock_Cert_Info</var>:
	<table class="~~syntaxTable~~">		<table class="thJustBold">
	<tr><th><var>COMMONNAME</var></th>		<tr><th><var>COMMONNAME</var></th>
	<td>Any name used to identify the client. Could be a first name/last name, an ID number, or even a userid. <var>COMMONNAME</var> can be abbreviated <var>CN</var>, <var>CNAME</var>, or <var>COMMONN</var>. </td></tr>		<td>Any name used to identify the client. Could be a first name/last name, an ID number, or even a userid. <var>COMMONNAME</var> can be abbreviated <var>CN</var>, <var>CNAME</var>, or <var>COMMONN</var>. </td></tr>

	<tr><th><var>ORGANIZATIONALUNIT</var></th>		<tr><th><var>ORGANIZATIONALUNIT</var></th>
	<td>The department or section of the organization to which the user belongs. For example, "Physics Department,"Accounts receivable," or "Web doods." <var>ORGANIZATIONALUNIT</var> can be abbreviated <var>ORGU</var>, <var>ORGANIZATIONALU</var>, or <var>ORGUNIT</var>. </td></tr>		<td>The department or section of the organization to which the user belongs. For example, "Physics Department,"Accounts receivable," or "Web doods." <var>ORGANIZATIONALUNIT</var> can be abbreviated <var>ORGU</var>, <var>ORGANIZATIONALU</var>, or <var>ORGUNIT</var>. </td></tr>

	<tr><th><var>ORGANIZATION</var></th>		<tr><th><var>ORGANIZATION</var></th>
	<td>The company, government agency, school, or other organization to which the client belongs. For example, "Hard Knocks University," "Effete Recordings," or "bagsofconcrete.com." <var>ORGANIZATION</var> can be abbreviated <var>ORG</var>. </td></tr>		<td>The company, government agency, school, or other organization to which the client belongs. For example, "Hard Knocks University," "Effete Recordings," or "bagsofconcrete.com." <var>ORGANIZATION</var> can be abbreviated <var>ORG</var>. </td></tr>

	<tr><th><var>LOCALITY</var></th>		<tr><th><var>LOCALITY</var></th>
	<td>The city, town, or village in which the subject resides or works. <var>LOCALITY</var> can be abbreviated <var>LOC</var>.		<td>The city, town, or village in which the subject resides or works. <var>LOCALITY</var> can be abbreviated <var>LOC</var>.
	</td></tr>		</td></tr>

	<tr><th><var>STATE</var></th>		<tr><th><var>STATE</var></th>
	<td>The state, province, or other intermediate governmental unit in which the subject resides or works. <var>PROVINCE</var> is a synonym for <var>STATE</var>. </td></tr>		<td>The state, province, or other intermediate governmental unit in which the subject resides or works. <var>PROVINCE</var> is a synonym for <var>STATE</var>. </td></tr>

	<tr><th><var>COUNTRY</var></th>		<tr><th><var>COUNTRY</var></th>
	<td>The country or nation in which the subject resides or works. </td></tr>		<td>The country or nation in which the subject resides or works. </td></tr>
Line 52:		Line 60:
	<p>		<p>
	<var>EXPIRATIONDATE</var> can be abbreviated <var>EXPIRYDATE</var>, <var>EXPDATE</var>, or <var>EDATE</var>, or it can be requested as <var>EXPIRATIONTIME</var>, <var>EXPIRYTIME</var>, <var>EXPTIME</var>, or <var>ETIME</var>. </p></td></tr>		<var>EXPIRATIONDATE</var> can be abbreviated <var>EXPIRYDATE</var>, <var>EXPDATE</var>, or <var>EDATE</var>, or it can be requested as <var>EXPIRATIONTIME</var>, <var>EXPIRYTIME</var>, <var>EXPTIME</var>, or <var>ETIME</var>. </p></td></tr>

	<tr><th><var>SERIALNUMBER</var></th>		<tr><th><var>SERIALNUMBER</var></th>
	<td>The serial number of the subject's certificate as assigned by the signer. Certifying authorities should assign a unique serial number to each certificate they sign. The assigned serial number could be a number that goes up by one for each certificate signed by a certifying authority, or it could be a number derived from the date and time, for example.		<td>The serial number of the subject's certificate as assigned by the signer. Certifying authorities should assign a unique serial number to each certificate they sign. The assigned serial number could be a number that goes up by one for each certificate signed by a certifying authority, or it could be a number derived from the date and time, for example.
Line 128:		Line 137:
	If another function or method causes a renegotiation by requesting		If another function or method causes a renegotiation by requesting
	a client certificate, a subsequent <var>$Sock_Cert_Info</var> or <var>$Sock_Cert_Levels</var> call		a client certificate, a subsequent <var>$Sock_Cert_Info</var> or <var>$Sock_Cert_Levels</var> call
	will '''not''' cause another request for a client certificate, whether or not a client certificate		will '''not''' cause another request for a client certificate, whether or not a client certificate was returned for the initial renegotiation.
	was returned for the initial renegotiation.
	This is because: </p>		This is because: </p>
	<ul>		<ul>
	<li>There is no reason a client would not return a certificate on an initial		<li>There is no reason a client would not return a certificate on an initial
	renegotiation, but return a certificate on a later renegotiation.		renegotiation, but return a certificate on a later renegotiation. </li>

	<li>There is no reason a client would return a certificate on an initial		<li>There is no reason a client would return a certificate on an initial
	renegotiation, then return a different client certificate on a subsequent SSL renegotiation.		renegotiation, then return a different client certificate on a subsequent SSL renegotiation. </li>
	</ul>		</ul>
	</ul>		</ul>

	[[Category: Janus Sockets $functions]]		[[Category: Janus Sockets $functions]]

JAL: /* Usage notes */

2014-08-25T16:02:14Z

Usage notes

← Older revision		Revision as of 16:02, 25 August 2014
Line 109:		Line 109:
	if a Janus SSL server program issues <var>$Sock_Cert_Info</var> or <var>[[$Sock_Cert_Levels]]</var>,		if a Janus SSL server program issues <var>$Sock_Cert_Info</var> or <var>[[$Sock_Cert_Levels]]</var>,
	the returned string will be null if		the returned string will be null if
	the server port definition includes the <var>[[SSLCLCERT]]</var> or <var>[[SSLCLCERTR]]</var> parameter.		the server port definition includes the <var>[[SSLCLCERT and SSLCLCERTR\|SSLCLCERT]]</var> or <var>[[SSLCLCERT and SSLCLCERTR\|SSLCLCERTR]]</var> parameter.
	Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the		Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the
	initial server-client handshake that establishes the SSL connection.		initial server-client handshake that establishes the SSL connection.

JAL at 21:33, 23 July 2013

2013-07-23T21:33:07Z

← Older revision		Revision as of 21:33, 23 July 2013
Line 2:		Line 2:
	<span class="pageSubtitle">Value of entity in partner's certificate</span>		<span class="pageSubtitle">Value of entity in partner's certificate</span>
	<p class="warn"><b>Note: </b>Most Sirius $functions have been deprecated in favor of Object Oriented		<p class="warn"><b>Note: </b>Most Sirius $functions have been deprecated in favor of Object Oriented
	methods. ~~There is currently no direct~~ OO equivalent for ~~this~~ $function. </p>		methods. The OO equivalent for <var>$Sock_Cert_Info</var> is the <var>[[CertInfo (Socket function)\|CertInfo]]</var> method. </p>

	<var>$Sock_Cert_Info</var> retrieves the value of an entity for one of the		<var>$Sock_Cert_Info</var> retrieves the value of an entity for one of the

JALWiccan: Automatically generated page update

2013-07-19T18:59:22Z

Automatically generated page update

← Older revision		Revision as of 18:59, 19 July 2013
Line 1:		Line 1:
	{{DISPLAYTITLE:$Sock_Cert_Info}}		{{DISPLAYTITLE:$Sock_Cert_Info}}
	<span class="pageSubtitle">Value of entity in partner's certificate</span>		<span class="pageSubtitle">Value of entity in partner's certificate</span>
	<p class="~~warning~~">Most Sirius $functions have been deprecated in favor of Object Oriented		<p class="warn"><b>Note: </b>Most Sirius $functions have been deprecated in favor of Object Oriented
	methods. There is currently no direct OO equivalent for this $function. </p>		methods. There is currently no direct OO equivalent for this $function. </p>

Admin: 1 revision

2012-01-20T02:53:45Z

1 revision

← Older revision	Revision as of 02:53, 20 January 2012
(No difference)

JAL at 23:07, 19 January 2012

2012-01-19T23:07:32Z

New page

{{DISPLAYTITLE:$Sock_Cert_Info}}
Value of entity in partner's certificate
Most Sirius $functions have been deprecated in favor of Object Oriented
methods. There is currently no direct OO equivalent for this $function. 

<var>$Sock_Cert_Info</var> retrieves the value of an entity for one of the
levels of the certificate provided on a socket by the remote partner.

==Syntax==
%string = $Sock_Cert_Info(socket, entity, [level]) 

===Syntax terms===
<table class="syntaxTable">
<tr><th>%string</th>
<td>The value of the requested entity at the requested level of the certificate supplied by the remote partner.
If no such certificate was provided, the null string is returned.</td></tr>
<tr><th>socket</th>
<td>A string that is the socket identifier.</td></tr>
<tr><th>entity</th>
<td>The name of the requested entity. Valid values are described [[#Certificate entities|below]]. </td></tr>
<tr><th>level</th>
<td>The certificate level at which to obtain the entity: Level 0 corresponds to the client or the "subject" of the certificate; level 1 corresponds to the "signer" of the certificate; level 2 corresponds to the "signer" of the level 1 signer's certificate; and so on.

This argument is optional; the default value is 1.
For more information about certificate levels, see the [http://www.sirius-software.com/maint/download/jansslr.pdf Janus Network Security Reference Manual].</td></tr>
</table>

===Certificate entities===
The following entities can be requested with <var>$Sock_Cert_Info</var>:
<table class="syntaxTable">
<tr><th><var>COMMONNAME</var></th>
<td>Any name used to identify the client. Could be a first name/last name, an ID number, or even a userid. <var>COMMONNAME</var> can be abbreviated <var>CN</var>, <var>CNAME</var>, or <var>COMMONN</var>. </td></tr>
<tr><th><var>ORGANIZATIONALUNIT</var></th>
<td>The department or section of the organization to which the user belongs. For example, "Physics Department,"Accounts receivable," or "Web doods." <var>ORGANIZATIONALUNIT</var> can be abbreviated <var>ORGU</var>, <var>ORGANIZATIONALU</var>, or <var>ORGUNIT</var>. </td></tr>
<tr><th><var>ORGANIZATION</var></th>
<td>The company, government agency, school, or other organization to which the client belongs. For example, "Hard Knocks University," "Effete Recordings," or "bagsofconcrete.com." <var>ORGANIZATION</var> can be abbreviated <var>ORG</var>. </td></tr>
<tr><th><var>LOCALITY</var></th>
<td>The city, town, or village in which the subject resides or works. <var>LOCALITY</var> can be abbreviated <var>LOC</var>.
</td></tr>
<tr><th><var>STATE</var></th>
<td>The state, province, or other intermediate governmental unit in which the subject resides or works. <var>PROVINCE</var> is a synonym for <var>STATE</var>. </td></tr>
<tr><th><var>COUNTRY</var></th>
<td>The country or nation in which the subject resides or works. </td></tr>

<tr><th><var>VALIDITYDATE</var></th>
<td>The date on which the subject's or signer's certificate became valid. <var class="product">Janus Network Security</var> will not accept a client certificate where the subject's or signer's certificate is not yet valid, so use of this field is largely informational.

<var>VALIDITYDATE</var> is returned as a date string in <code>YYYYMMDDHHMISS</code> format. <var>VALIDITYDATE</var> can be abbreviated <var>VALIDDATE</var> or <var>VDATE</var>, or it can be requestedas <var>VALIDITYTIME</var>, <var>VALIDTIME</var>, or <var>VTIME</var>. </td></tr>

<tr><th><var>EXPIRATIONDATE</var></th>
<td>The date on which the subject's or signer's certificate becomes invalid. <var class="product">Janus Network Security</var> will not accept a client certificate where the subject's or signer's certificate is no longer valid, so use of this field is largely informational, though it might prove useful in providing a warning to a user whose certificate is going to expire soon.

<var>EXPIRATIONDATE</var> can be abbreviated <var>EXPIRYDATE</var>, <var>EXPDATE</var>, or <var>EDATE</var>, or it can be requested as <var>EXPIRATIONTIME</var>, <var>EXPIRYTIME</var>, <var>EXPTIME</var>, or <var>ETIME</var>. </td></tr>
<tr><th><var>SERIALNUMBER</var></th>
<td>The serial number of the subject's certificate as assigned by the signer. Certifying authorities should assign a unique serial number to each certificate they sign. The assigned serial number could be a number that goes up by one for each certificate signed by a certifying authority, or it could be a number derived from the date and time, for example.

<var>SERIALNUMBER</var> is returned as a hexadecimal string with an even number of hexadecimal digits. Since the signer's certificate is generally "self-signed," it often does not have a serial number, that is, the level 1 serial number is usually returned as a null.

While <var>SERIALNUMBER</var> doesn't have any particular significance from an application level, it can be used as an extra piece of identifying information for a client certificate. <var>SERIALNUMBER</var> can be abbreviated <var>SERIALNUM</var>, <var>SERNUMBER</var>, <var>SERNUM</var>, <var>SERIAL</var> or <var>SER</var>. </td></tr>

<tr><th><var>PRIVATEKEYLENGTH</var></th>
<td>The length of the private key used by the signer or the client. Private key lengths are usually expressed in terms of number of bits, so <var>PRIVATEKEYLENGTH</var> returns a decimal number string, such as "512" or "1024".

This value could be used to determine a "level of trustworthiness" of a client certificate, where a 512-bit certificate is considered somewhat weak (though probably strong enough for all but the most extreme security requirements), and a 1024-bit certificate is considered strong. <var class="product">Janus Network Security</var> will not accept certificates that indicate private keys shorter than 512 bits or longer than 2048 bits. Generally, client certificates use either a 512-bit or a 1024-bit key. 

<var>PRIVATEKEYLENGTH</var> can be abbreviated <var>PRIVATEKEYL</var>, <var>PKEYLENGTH</var>, or <var>PKEYL</var>. </td></tr>

<tr><th><var>TEMPORARYKEYLENGTH</var></th>
<td>The length of the temporary or "ephemeral" private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless anyway, <var>TEMPORARYKEYLENGTH</var> always returns a 0
(<var>$Sock_Cert_Info</var>) or Socket object method (<var>[[CertInfo (Socket function)|CertInfo]]</var>).

<var>TEMPORARYKEYLENGTH</var> can be abbreviated <var>TEMPORARYKEYL</var>, <var>TEMPKEYLENGTH</var> or <var>TEMPKEYL</var>. </td></tr>

<tr><th><var>PERMANENTKEYLENGTH</var></th>
<td>The length of the permanent private key. Since SSL client certificate support does not cover ephemeral private keys, and in fact, such support would be largely meaningless
anyway, <var>PERMANENTKEYLENGTH</var> always returns a the same value as <var>PRIVATEKEYLENGTH</var>. It is simply included here for compatibility with the equivalent <var class="product">Janus Sockets</var> function (<var>$Sock_Cert_Info</var>) or
Socket object method (<var>CertInfo</var>).

<var>PERMANENTKEYLENGTH</var> can be abbreviated <var>PERMANENTKEYL</var>, <var>PERMKEYLENGTH</var>, or <var>PERMKEYL</var>.
</td></tr>

<tr><th><var>MD5HASH</var>
</th><td>The MD5 hash or "digest" of the subject or issuer certificate. The MD5 hash of a certificate is shown by some browsers when displaying certificate information. An MD5 hash is always a 16-byte value, so <var>MD5HASH</var> always returns a 32-character hexadecimal string.

Since it is basically impossible for any two different certificates to have the same MD5 hash, the MD5HASH value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the MD5 hash of the certificate can be used a primary unique key to locate the certificate. 

<var>MD5HASH</var> can be abbreviated MD5. </td></tr>

<tr><th><var>SHAHASH</var></th>
<td>The SHA hash or "digest" of the subject or issuer certificate. The SHA hash of a certificate is shown by some browsers when displaying certificate information. An SHA hash is always a 20-byte value, so <var>SHAHASH</var> always returns a 40-character hexadecimal string.

Since it is basically impossible for any two different certificates to have the same SHA hash, the SHAHASH value can be used in and of itself as a unique identification of a certificate. That is, if certificate information is stored in a database, the SHA hash of the certificate can be used a primary unique key to locate the certificate. 

<var>SHAHASH</var> can be abbreviated <var>SHA</var>. </td></tr>
</table>

==Usage notes==
<ul>
<li><var>$Sock_Cert_Info</var> returns the null string if the socket is not open
and <var>ONRESET CONTINUE</var> is in effect for the socket.

For example, this statement returns the name of the organization at level 1
of the certificate provided by the partner that sent the request for the server (<var>SRVSOCK</var>) socket:
%org = $Sock_Cert_Info(1, 'ORGANIZATION', 1)


<div id="renegotiate"></div>
<li>As of <var class="product">Sirius Mods</var> 7.7,
if a Janus SSL server program issues <var>$Sock_Cert_Info</var> or <var>[[$Sock_Cert_Levels]]</var>,
the returned string will be null if
the server port definition includes the <var>[[SSLCLCERT]]</var> or <var>[[SSLCLCERTR]]</var> parameter.
Those <var>JANUS DEFINE</var> parameters cause a request for a client certificate in the
initial server-client handshake that establishes the SSL connection.
The <var>$Sock_Cert_Info</var> or <var>$Sock_Cert_Levels</var> call in this case would be a second
request for a certificate,
and a client certificate may only be requested once for an SSL session
(whether or not the request successfully gets a certificate in return).

If neither of those <var>JANUS DEFINE</var> parameters are specified,
a server's <var>$Sock_Cert_Info</var> or <var>$Sock_Cert_Levels</var> call will cause an SSL
renegotiation (that is, a new handshake) that requests a digital certificate from the client.
This allows a port to require a client certificate for some content, but not for other content. 

In the renegotiation, the server requests a certificate, but does '''not''' insist that the client present one.
The returned string from the method call may therefore still be null
because no certificate was provided. 

If another function or method causes a renegotiation by requesting
a client certificate, a subsequent <var>$Sock_Cert_Info</var> or <var>$Sock_Cert_Levels</var> call
will '''not''' cause another request for a client certificate, whether or not a client certificate
was returned for the initial renegotiation.
This is because: 
<ul>
<li>There is no reason a client would not return a certificate on an initial
renegotiation, but return a certificate on a later renegotiation.
<li>There is no reason a client would return a certificate on an initial
renegotiation, then return a different client certificate on a subsequent SSL renegotiation.
</ul>
</ul>

[[Category: Janus Sockets $functions]]