It seems the discussion about misissuance is going into far too many different policy decisions favoured by different people. That makes it obvious that it does not belong in the base specification document.
The goal is to provide a distributed logging infrastructure that people can use with their clients and monitors. Consumers and providers can pick those that match their operational expectations and policies. Logs will have different policies on which kind of certificates they will accept into the log or not. But we should not come up with policies for people running the logs in different commercial or legal systems. Each will develop their own rules. The focus should be on what the minimum requirements are for inclusion into the log in such a way that the log is able to fulfill its function. Being resistant to spam/dos attacks is an important factor. But should we just mention it in the security sections and leave it open for everyone to decide on? Someone might want _only_ self signed certificates in their log server and it would be wrong if the base specification would forbid that. The serial number seems to be a hard requirement, as it is needed to uniquely identify the certificate. CABF policy is not. I'm sure there will be logs that will only allow EV certs. That's fine. Those policies do not belong in our document. For the base document, we need to focus only on the requirements needed for self-preservation of the log. If someone is interested in writing a separate policy document for a specific type of log, that would be great. For instance a log that only takes in CABF members issued certificates. Paul _______________________________________________ Trans mailing list [email protected] https://www.ietf.org/mailman/listinfo/trans
