Re: [Dtls-iot] IP Addresses in Certificates

[Stephen Farrell <[e-mail]>]

Hiya,

On 15/07/15 12:07, Hannes Tschofenig wrote:
> Stephen wrote:
> 
> (5) 6.3: Forgetting CoAP for the moment, surely this profile will be
> used with devices that only have (possibly bogon) IP addresses and that
> want to have those in certs. I do get that how to handle that well is
> not very clear, esp. for certs for e.g. 192.168.0.1, but shouldn't it
> really be covered by this profile?

I should also have mentioned link-local addresses too I guess.

> 
> In general, it is not clear how server-side certificates work with IoT
> devices that do not use DNS. This motivated us to write a separate
> document about this topic, see ​
> https://tools.ietf.org/html/draft-fossati-core-certmode-rd-names-01

That's a new one on me. I can see where you're coming from but
IMEI's in certificates is pretty iccky, even if it's only for
a sensor-with-a-SIM device. So I dunno if that's the "right" or
best answer to be honest.

> For client certificates it does not really matter that much what you put
> into the certificates since the content is only matched against an
> access control policy (without further interpreting the structure of the
> identifier).
> 
> So, are you talking about server or client-side certificates?

(D)TLS servers mostly.

I guess to the extent there are devices doing TLS client auth,
those too, but I do agree that in most cases there'll be another
identifier used that isn't an IP address, so the (D)TLS client
side is a secondary issue.

S.


> 
> 
> 
> _______________________________________________
> dtls-iot mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>