Re: [CDNi] Review of draft-ietf-cdni-delegation-acme-00

[Thomas Fossati <[e-mail]>]

I just realised I had another comment that got lost in the translation
between my notes and the email... which is: the lifetime-adjust property
should be optional rather than mandatory, to mirror the STAR definitions
in Section 3.1.1 [1].

cheers, t
[1] https://www.rfc-editor.org/rfc/rfc8739#section-3.1.1

On 24/01/2023, 10:10, "Thomas Fossati" [e-mail]<mailto:[e-mail]> wrote:
>
> Hi Fred, Sanjay and Emile,
>
> I have reviewed the latest draft and it looks good to me.
>
> There are a few comments & suggestions below.
>
> Cheers, t
>
> -=-=-=-=-=-
>
> ## abstract
>
> * why plural "metadata objects"?  Suggestion:
>
> OLD
>
> Specifically, this document defines CDNI Metadata interface objects to
> enable delegation of X.509 certificates leveraging delegation schemes
> defined in RFC9115.
>
> NEW
>
> Specifically, this document defines a CDNI Metadata interface object
> to enable delegation of X.509 certificates leveraging delegation
> schemes defined in RFC9115.
>
>
> ## §1
>
> * expand FCI on first use:
>
>  Section 2 presents delegation metadata for the FCI interface.
>
>
> ## §3
>
> * typo (extra “to”)
>
>   When a uCDN delegates to a dCDN to deliver HTTPS traffic using DNS
>   Redirection [RFC7975],
>
>   When a uCDN delegates a dCDN to delivery of HTTPS traffic using DNS
>   Redirection [RFC7975],
>
>
> * typo (missing parentheses):
>
> OLD
>
>    The ACMEDelegationMethod applies to both ACME STAR delegation,
>    which provides a delegation model based on short-term certificates
>    with automatic renewal Section 2.3.2 of [RFC9115], and non-STAR
>    delegation, which allows delegation between CDNs using long-term
>    certificates Section 2.3.3 of [RFC9115].
>
> NEW
>
>    The ACMEDelegationMethod applies to both ACME STAR delegation,
>    which provides a delegation model based on short-term certificates
>    with automatic renewal (Section 2.3.2 of [RFC9115]), and non-STAR
>    delegation, which allows delegation between CDNs using long-term
>    certificates (Section 2.3.3 of [RFC9115]).
>
> ## §3.1
>
> * this seems to suggest that the consumer can tell STAR and non-STAR
>   based on "delegation certificate validity", but it's not clear to me
>   what that means.
>
>    The ACMEDelegationMethod object allows a uCDN to both define STAR
>    and non-STAR delegation depending on the delegation certificate
>    validity.
>
>   From the following examples (§3.1.1) I gather there's an implicit
>   way to distinguish based on the presence/absence of the lifetime*
>   properties.  Is that what was intended?  If so, it should be
>   clarified.


IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.