<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Good afternoon.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
As far as I can tell, when QuickFIX/n attempts to authenticate using TLS, the <b>
clientCertificates</b> it passes as a parameter in <b>SSLStreamFactory.CreateClientStreamAndAuthenticate</b> will only ever pass a single certificate.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<b>SSLStreamFactory.GetClientCertificates</b> adds a single certificate to the collection from
<b>StreamFactory.LoadCertificate</b>,<b> </b>which loads the first valid certificate from the store, or loads a certificate from file.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The IETC RFC for TLS1.2 specifies (in <a href="https://tools.ietf.org/html/rfc5246#section-7.4.6">https://tools.ietf.org/html/rfc5246#section-7.4.6</a>) that "This message conveys the client's certificate
<b>chain</b> to the server"</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This seems to suggest that QuickFIX/n is not TLS1.2 compliant.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Whilst the current approach works for some connections, others (such as MarketAxess) are rejecting the connection as they require the full certificate chain to be present, as per the RFC.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is this a known issue, and are there any plans to address?<br>
<br>
Thanks,<br>
Campbell</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<br>
<hr>
<font face="Arial" color="Black" size="1"><br>
This e-mail, including accompanying communications and attachments, is strictly confidential and only for the intended recipient. Any retention, use or disclosure not expressly authorised by IHSMarkit is prohibited. This email is subject to all waivers and
other terms at the following link: https://ihsmarkit.com/Legal/EmailDisclaimer.html<br>
<br>
Please visit www.ihsmarkit.com/about/contact-us.html for contact information on our offices worldwide.<br>
</font>
</body>
</html>