Re: [dispatch] please dispatch draft-bhjl-x509-srv-02.xml

["John Levine" <[e-mail]>]

>Yeah, that seems like it might be OK in some sort of informational document
>describing common practice, but this document is asking for Standards
>Track, and in that situation it seems like actually specifying one class of
>behavior is the superior direction.

Sure, if that were feasible.  I see no chance at all of getting a
sufficient agreement that domains are authorititative, or that they
aren't.  From what I've seen so far, few people have even thought
about it, and fewer still outside the context of whatever mail system
they personally are running.  People at gmail said they're interested
in this, so I can ask if they've thought about it in the context of
a very large public mail system.

>> Good point, MUST for https seems obvious.
>
>I don't just mean MUST for HTTP, but also encouraging the use of valid
>certs.

OK.

>> Again, this is out of RFC 4387.  I was under the impression that the
>> client could look at the certs and see what chained to what.
>
>The text in 4387 is not maximally clear. It appears that perhaps the idea
>is that this is just EE certs. If it's a mix of multiple EE and chain
>certs, it's not reasonable to expect the RP to make sense of it. In any
>case, this text should be clear.

I am not a great pkix expert, so pointers and suggestions are welcone.

R's,
John