Re: Stephen Farrell's No Objection on draft-ietf-httpbis-alt-svc-12: (with COMMENT)

[Martin Thomson <[e-mail]>]

On 7 March 2016 at 13:19, Mark Nottingham <[e-mail]> wrote:
> It's just saying that clients can and use additional means to validate certificates; i.e., they're not obligated to accept a cert if it passes the 2818 checks.

In practice, browsers do pinning checks, blacklist checks, revocation
checks [1], CT signature checks, user override checks, and probably
things that I'm not aware of.  The intent was to avoid limiting
validation behaviour.  My initial reaction was that this wasn't
interoperable.  I still think we could do better, but don't want to
burden this effort unreasonably, defining what it means to validate a
certificate turns out to be hard.

[1] Hah, had you going there, we don't. Well... unless there is a
must-pin policy.