[Dance] Re: Last Call: <draft-ietf-dance-client-auth-14.txt> (TLS Client Authentication via DANE TLSA records) to Proposed Standard

[Kaveh Ranjbar <[e-mail]>]

I support publication of this document as Proposed Standard.

I reviewed -13 in the working group last call and have read -14 since. The
one substantive thing I raised, how a server should treat an authenticated
denial of existence, an unsigned zone or an insecure delegation as opposed
to a plain validation failure, is now handled explicitly in the server
procedure and it reads right to me. We run DANE TLSA for client and agent
identities in production, the rules here match what an implementer needs,
and I see nothing that should hold it up.

All the best,
Kaveh

On Tue, Sep 15, 2026 08:01 PM, The IESG <[e-mail]> wrote:

>
> The IESG has received a request from the DANE Authentication for Network
> Clients Everywhere WG (dance) to consider the following document: - 'TLS
> Client Authentication via DANE TLSA records'
>   <draft-ietf-dance-client-auth-14.txt> as Proposed Standard
>
> This is a second IETF Last Call; this draft combines the
> dance-tls-clientid and dance-client-auth draft into one specification. It
> addresses all of the first IETF Last Call comments.
>
> The IESG plans to make a decision in the next few weeks, and solicits final
> comments on this action. Please send substantive comments to the
> [e-mail] mailing lists by 2026-09-29. Exceptionally, comments
> may
> be sent to [e-mail] instead. In either case, please retain the
> beginning
> of the Subject line to allow automated sorting.
>
> Abstract
>
>
>    The DANE TLSA protocol describes how to publish Transport Layer
>    Security (TLS) server certificates or public keys in the DNS.  This
>    document updates RFC 6698 and RFC 7671.  It describes how to use the
>    TLSA record to publish client certificates or public keys, and also
>    the rules and considerations for using them with TLS.  In addition,
>    it defines a new TLS extension, DANE Client Identity, to convey the
>    client's domain name identity to the server.
>
>
>
>
> The file can be obtained via
> https://datatracker.ietf.org/doc/draft-ietf-dance-client-auth/
>
>
>
> No IPR declarations have been submitted directly on this I-D.
>
>
>
>
>
> _______________________________________________
> Dance mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>