3. Requirements Overview
o MUST support secure transport as defined in [RFC2818] using TLS
[RFC5246];
This recently came up in review of
draft-ietf-geopriv-http-location-delivery-15.txt:
RFC 2818, Section 3.1 says:
Matching is performed using the matching rules specified by
[RFC2459]. If more than one identity of a given type is present in
the certificate (e.g., more than one dNSName name, a match in any one
of the set is considered acceptable.) Names may contain the wildcard
character * which is considered to match any single domain name
component or component fragment. E.g., *.a.com matches foo.a.com but
not bar.foo.a.com. f*.com matches foo.com but not bar.com.
Based on the discussion during an IESG telechat several ADs agreed that
f* wildcards shouldn't be allowed anymore. So, the document should say
that it complies with RFC 2818, except for f* type wildcards are not
allowed. (wildcards in the leftmost label are still allowed). This is
consistent with the advice from RFC 5280.
I also think this document should reference RFC 5280.