At 4:15 PM +1000 9/21/09, Terry Manderson wrote:
On 19/09/2009, at 3:23 AM, Stephen Kent wrote:
We were told over a year ago that, because of legitimate transfers,
looking for duplicates was bad idea, in the repository system. So,
I'm not sure if we want to do it in the 'assimilated relying party
rpki.'
So legitimate transfers will breed duplicates? My recollection of
that discussion that there would be timing in place that certificate
validity times would be tuned (with sparse use of CRLs) to effect
the transfers. Or am I mistaken?
I have been told that it is likely that certs issued in conjunction
with transfers will overlap in validity intervals.
I think, if anywhere you needed to go looking for duplicates it
would be the relying party software (either your software or rcynic)
before it mades it to the router "decision"
Yes, and I was referring to RP software trying to look for duplicates
in the certs it downloads.
...
If your software can change the contents of the 3779 extensions,
would it not be a simple exercise to change the SIA value?
The model for our local TA management system does not require any
changes to SIA values, because all of the changes are purely local.
And, as I noted, 3rd party CAs are not consistent with the CP.
Steve
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
