StartTLS vs SSL?

[Daniel Fisher]

On Thu, Apr 2, 2015 at 4:54 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Derp Niner <derpniner at gmail.com> [2015-04-02 03:03]:
> > I would like to know which one is preferred (and why if you have a
> > few minutes to explain).
>
> One simple answer is that there is no specification for LDAPS, it's
> only a de facto "standard".
> OTOH the LDAP Technical Specifications (RFC4510) also contain RFC4513
> which has an implementation requirement for StartTLS if you wanted to
> support Simple binds (not SASL authn method).
> So if you cared about Internet Standards you have your answer.
>

In addition to what Peter said, startTLS functionality in Java has better
APIs built around it.
Since most directories support startTLS it made sense to be the default
option.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150402/93f04b1a/attachment-0001.html