On 19/10/15 14:29, Tom Ritter wrote:
On 19 October 2015 at 06:31, Rob Stradling wrote:
On 17/08/15 18:24, 'Adam Eijdenberg' via certificate-transparency wrote:
(posted to [email protected], [email protected]
and [email protected])
<snip>
Lookahead:
- We're very interested in exploring how we make it viable for a
site-owner to be able to opt-in to requiring CT, ahead of any general
browser-enforced deadlines. We would welcome participation in helping
define what this might look like in a manner that would work well for
both browsers and site-owners.
Adam,
RFC 7633: "X.509v3 Transport Layer Security (TLS) Feature Extension"
This newly standardized certificate extension could be used to signal that
the TLS server MUST send the CT TLS extension.
I realize that this may not suit many early adopters, since few deployed
servers support the CT TLS extension yet. But I figured it was worth
mentioning.
It could... but that seems awfully limited. Requiring CT is a lot
easier than requiring one of the specific forms. If you change
infrastructure, and lose the ability to include a TLS Extension, you
can at least staple OCSP or get them embedded in a cert.
That's true.
Perhaps 6962-bis should prohibit or recommend against using TLS Feature
for the CT TLS extension then. Or...
Actually, I can't find any explicit requirement in RFC7633 that says
words to the effect of "The TLS server MUST send TLS extension X". The
actual requirements are expressed more vaguely than that. e.g.
"A server offering an end-entity certificate with a TLS feature
extension MUST satisfy a client request for the specified feature"
"If these features are requested by the client in its ClientHello
message, then the server MUST return a ServerHello message that
satisfies this request."
So, perhaps 6962-bis could specify that, if a TLS client sends the CT
TLS extension and the TLS server's cert contains the TLS Feature cert
extension with the CT TLS extension identifier, then the TLS server MUST
"satisfy the request" by sending SCTs via any of the three supported
mechanisms (CT TLS extension, cert extension, stapled OCSP response
extension).
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
_______________________________________________
Trans mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/trans
