Re: [Add] [Ext] Updated charter proposal for ADD

[Brian Dickson <[e-mail]>]

On Wed, Jan 15, 2020 at 2:27 PM Ted Lemon <[e-mail]> wrote:

> On Jan 15, 2020, at 5:20 PM, Rob Sayre <[e-mail]> wrote:
>
> The point wasn't limited to home routers, although it does apply there.
>
>
> OK.   For an enterprise user, the easiest thing to do is just get a cert.
>   The IP address doesn’t matter.   If you want to use ACME, you might need
> to do some gymnastics, but you can make it work.   An operational document
> that describes how this works might be useful.
>


> I don’t think there’s any new protocol work to do here.
>

Maybe, maybe not. Or maybe not new protocol work, but separating which RFCs
are informative vs normative might be a big issue.

Specifically, it has to do with scope, when considering the question of
certificate validation.

The scope of the WG charter is larger than WWW use of DNS.

The related scope question is whether it is appropriate to rely exclusively
on the WebPKI rules (including trusted CAs) for validation of X.509
certificates used for DNS.

This has to do with MTI, and interoperability. It isn't going to be a
successful outcome to the WG if the result only works for browser clients
incorporating WebPKI elements (trusted CA set, and revocation via
OCSP/CRL/CT exclusively), as opposed to use of DANE (single trusted public
DNS trust anchor, and revocation by unpublishing DNSKEYs in DNS) and
possible use of non-public DNS trust anchors.

Brian