Re: PP7: Server Identity Check

[Kurt Zeilenga <[e-mail]>]

>>
>> Which apparently is either being referenced in various RFCs/I-Ds,  
>> or is being ignored in other various I-Ds/RFCs, who then re-invent  
>> their own version, or don't at all.


RFC 2830 was obsoleted by RFC 4513.  While RFC 4313 (in Section 3.1.3)  
retains the basic server identity checks described in RFC 2830, it  
does expand on server identity checks a bit.  For instance, RFC 4513  
discussions not only checks based upon DNS names, but also discussions  
checks based upon IP addresses and other subjectName types.  The DNS  
name check specification also has been updated to discuss IDNA issues.

>>
>> Thus it has been suggested (by ChrisN to me, at Vancouver last  
>> month) to extract the above and make it into a BCP applicable to at  
>> least the apps area.
>>
>> So also from RFC2830, are sections..
>>
>> ..or any of the other RFC2830 (sub)sections relevant for inclusion  
>> in this postulated BCP?

I think Section 3.1.3 of RFC 4513 might serve as a better basis for  
postulating a generic "server identity check" BCP in this than Section  
3.6 of RFC 2830.

-- Kurt