Re: [RAM] Renumbering impossibility: TSL/SSL certs, DNS delegation etc.

[Gert Doering <gert at space.net>]

Hi,

On Fri, Aug 03, 2007 at 12:37:10PM +1000, Robin Whittle wrote:
> If a server as an SSL certificate, that is specific to its physical
> IP address.  No amount of automation can help with that, or the cost
> and time-delay of getting another certificate.

Doing so in the first place could be considered a mistake.  The nice thing
about *names* is that you can (and should!) tie the SSL certificate to the 
domain name that you want to secure, not to the IP address.

[..]
> As far as I know, this notion of IPv6 end-users supposedly being
> happy with PA space and automated renumbering has been going on for
> ten years or so.  Hadn't anyone thought of all the config files
> (named, httpd, imapd, firewall etc.), SSL certs, DNS delegation etc.?

Most end user networks neither run name servers nor SSL certs, etc., in
their network range - they delegate that task to their service providers.

"all the config files" should contain host names, not IP addresses
(that's what DNS has been invented for, half a century ago).

Of course there are larger "end users" (corporate networks) that have
local servers in their network - but even then, with proper planning
in the setup phase (and that means "not putting IP addresses in places
that should have server names"), renumbering is not painless, but also
not impossible.  It mostly boils down to firewall rules, and changing
glue for a few name servers (again, the "proper planning" thing).

Gert Doering
        -- NetMaster
-- 
Total number of prefixes smaller than registry allocations:  113403

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (89) 32356-444            USt-IdNr.: DE813185279

_______________________________________________
RAM mailing list
RAM at iab.org
https://www1.ietf.org/mailman/listinfo/ram