Re: [TLS] AIA cert fetching seen as harmful

[Mike <mike-list at pobox.com>]

> Please look at a diagram of the US Federal Bridge CA PKI, or the equivalent
> bridged PKI in Japan or South Korea, and tell us how your proposal would
> work in those environments.

I don't know the specifics of any PKI, but I think the answer is
the same for any one of them.  A server can not blindly retrieve
any URL presented by a client, so it needs to be configured as to
what URL's are acceptable.  One way to accomplish that is to put
the information in the CA certificates as I suggested.

If your question was meant to say that this would be difficult
to do for those PKI's because servers don't know all of the
intermediate CA's and don't have all of their certificates, then
the answer is that they either need to be configured with those
missing certificates, or they can't safely support the client
certificate URL extension for those clients.  This seems to be
a case where you can't have your cake and eat it too.

Mike

_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls