Re: [ipwave] comments on the TLS certs draft

[Alexandre Petrescu <[e-mail]>]

I agree with the statements about deployment expectation and available 
commercial support, and with the existing sdos and sites asking for this 
draft.

On my side, I work for a few small deployments as well.

I need certificates now.

Allow me to be specific about my case.

I am in France: in order to obtain ITS-specific certificates I got 
redirected to a French enterprise named IDnomic.  It is a great company 
(presumably part of what you refer to as 'commercial support'). That has 
a website with ITS described as Object-ID https://www.idnomic.com/object-id/

However, on that web page, there is no button to press to ask a 
certificate.  IDnomic is not like, let's say, I asked a certificate to 
Let's Encrypt.   Let's Encrypt can offer me certificates in an automated 
manner; and not least important - for free.

On the downside, Let's Encrypt certificates are not specific for 
Vehicular networks.  (I suppose Let's Encrypt never heard about ITS 
extensions to certificates).

In this situation, what I do in my deployments, is to generate our own 
certificates, and sign them by our own CAs created locally.  The cars 
and traffic lights connect to our own openvpn server; they understand 
each other, because under same authority.

Yet, this situation is not something that can scale: I dont want more 
and more vehicles to connect to my server.  It risks becoming a single 
point of failure.

As a side note, I take advantage of this discussion to ask whether there 
is software implementation, or howto, that allows me to generate easily 
certificates with ITS extensions described in this draft.

I need these now (well, during the following months).

Alex

Le 29/03/2019 à 13:38, William Whyte a écrit :
> Alex, these certs are going to be widely deployed, and there is good 
> commercial support for them. We have standards organizations and 
> deployment sites asking for this draft.
> 
> Cheers,
> 
> William
> 
> 
> On Fri, Mar 29, 2019 at 8:37 AM Alexandre Petrescu 
> <[e-mail] <mailto:[e-mail]>> wrote:
> 
>     draft-tls-certieee1609-02
> 
>     draft-msahli-ipwave-ieee1609-00.txt
> 
> 
>     The certificates are highly necessary for securing IP based
>     communications in vehicle networks.
> 
>     But the conditions of their use may prevent deployment.
> 
>     - can I use an open source package to generate now a certificate
>     with features of these drafts?
> 
>     - is there a Certificate Authority that I can ask now to sign them?
> 
>     - can I do these two things for free now?
> 
>     Because in absence of these conditions, I am highly tempted to use
>     openvpn and its associated free tools to generate my own CA and my
>     own certificates to put in the cars I deal with.
> 
>     I think in practice several people do just that.
> 
>     I think it is a situation that needs to be prevented, because it
>     means the drafts are not used.
> 
>     Alex
> 
>     _______________________________________________
>     its mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/its
> 
> 
> 
> -- 
> 
> ---
> 
> I may have sent this email out of office hours. I never expect a 
> response outside yours.