[dispatch] draft-johansson-dispatch-dane-sip-01 - certificate validation

[Michael Procter <[e-mail]>]

Hi Olle,

I have read your draft on DANE for SIP, and have a question about
section 8.  The section starts with the statement:

   When using DANE-based validation the client validates the SRV
   hostname with the certificate using RFC 5922 rules.

I'm not sure we want to use the SRV hostname here.  RFC 5922 uses the
original domain before the NAPTR lookup (the AUS) which is probably
the same as the SRV hostname, but may be different[0].

I think we have to keep the mechanisms aligned to ensure that a
certificate that matches under RFC 5922 rules continues to match after
you add a TLSA RR.

Best regards,

Michael


[0] RFC 3263 Section 4.1, para 10 starts:
   It is not necessary for the domain suffixes in the NAPTR replacement
   field to match the domain of the original query (i.e., example.com
   above).