Re: [homenet] I-D Action: draft-ietf-homenet-dot-10.txt

[Toke Høiland-Jørgensen <[e-mail]>]

>> you couldn't use the fact that you can publish in a name in it
>> to do the ACME authentication.
>
> there SHOULD NOT be the ACME authentication or any neccessarity of any
> other authentication, as these domain names need not be unique ...
>
> in case you use 'teddynet.home.arpa.' and I use this domain name, too;
> we wouldn't have the same x509 SSL certificate, because each of us uses
> its own private key ...
>
> why not just define the org. that hosts the ARPA TLD (IANA?), as the CA
> for these domains and the root certificate as built in token to the common
> browsers and/or operating systems?
> there it should only be neccessary to upload the certificate request,
> gicwn the '.home.arpa.' domain name, and an email address where the
> certificate is sent to;
> the certificate will be a wild card certificate for this .home.arpa.
> domain ..
>
> I would want this to be added as additional section to this Draft/RFC;

If you're going through all this trouble of having a central API that
will hand out certificates, wouldn't it be possible to make that same
authority hand out pseudo-random unique subdomains (of some suitable
domain; not necessarily .home.arpa)? Then you are only an NS record from
solving the globally visible naming problem... :)

-Toke