The origin server receives cookies from a user-agent in a cookie request header. This proposal does not modify the cookie request header definition. The server may choose to use or ignore cookies supplied in such request headers. Upon receipt of such a cookie, it can return the same or a different cookie in the response, or no cookie at all. If it chooses to use the certificate information, then it must validate the certificates and can then decide whether to accept the cookies based on the privacy level of the certificates.
User agents determine the policy for accepting or rejecting cookies.
One suggested policy would be to accept cookies only from sites that are certified by an authority such as eTrust, regardless of whether the transaction is verified. User agents may also provide policy options that distinguish between verified and unverified transactions, for example by allowing all cookies in verified transactions and only certified cookies in unverified transactions. The user agent must be able to accept certificates from the authority named as the issuer. It need accept only one certificate in the header to validate the cookies. Thus, a server may send all its certificates, not knowing which a given user agent might accept.