At Wed, 16 Jun 2010 10:29:42 -0400, Stephen Kent wrote: > > At 3:37 PM -0700 6/15/10, Robert Kisteleki wrote: > >On 2010.06.14. 8:22, Rob Austein wrote: > >>So (a) I'm not sure I agree with the problem as stated, but (b) we > >>might just want to get rid of the AIA pointer anyway, or at least make > >>it purely advisory (not a res-certs profile conformance violation if > >>the AIA pointer is whacked). Not sure yet. Maybe both :). > > > >Please don't kill AIA, it's useful for discovery. I agree that you > >don't need to use it in verification though. > > I was just thinking about Robert's plan to use RPKI certs to verify > signed RPLS objects. This application needs AIA and the other > bottom-up cert path discovery methods that are common for PKI apps. > I don't know if we will have other such apps in the future, but if > so, this is an example of a situation where we cannot always rely on > a top-down cert acquisition methodology.
I am fine with keeping the AIA extension in the profile, so long as I'm not required to reject otherwise valid certificates because of disagreements between the AIA URI and the path at which I found the certificate in question. In other words, and unsurprisingly, I agree with RobK. _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
