Re: [dispatch] please dispatch draft-bhjl-x509-srv-02.xml

["John R Levine" <[e-mail]>]

>> Sure, if that were feasible.  I see no chance at all of getting a
>> sufficient agreement that domains are authorititative, or that they
>> aren't. ...

> This seems like a potential indicator that this technology is not yet ready
> for standardization.

Possibly, although since I talked in Berlin to people from one of the 
world's largest mail systems about implementing this, it seems we can try 
and figure out what we can standardize or we can stick our heads in the 
sand.

RFC 7929 and the forthcoming similar doc for S/MIME suggest that there is 
interest in domain authenticated certs.  But it may be that the interest 
is only in the DANE clique, in which case it would be easy enough to take 
out the domain authentication stuff and perhaps move it to a separate 
experimental draft.

> As I said previously, I kind of suspect that 4387 just meant that the 
> certs were all alternative EEs, but then you probably want some other 
> way to get the intermediates for the reason listed above, but in any 
> case you shouldn't just have them all in the same bucket. So, what's 
> probably best is to concretize this by saying that this bucket is just 
> for EE and then define some other mechanism for getting intermediates.

OK.  As I said, I'm not a great pkix expert, so whatever matches what 
S/MIME actually does would be great.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly