On Tue, Jul 23, 2019 at 5:23 PM Watson Ladd <watson= 40cloudflare....@dmarc.ietf.org> wrote:
> Suppose the following sequence of events happen: > > 1: A CA uses a new intermediate for reasons (no longer cross-signing, etc.) > 2: A site gets a certificate from the new intermediate. > 3: An older firefox version connects and thinks it knows all the > certificates in the world. > > This would seem to break and it wasn't clear to me how this would be > handled. Though as Martin points out this extension is merely codification > of an occasional practice, so maybe this case does actually work out. > I think the client would have to fall back and retry the TLS connection without requesting that intermediates be omitted. In general, I think this is the only reliable answer as AIA-chasing doesn't always work. (Either the AIA server can be down, or the chain can be from a private CA that doesn't support AIA.) Cheers AGL
_______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
