Re: [ipwave] comments on the TLS certs draft

[William Whyte <[e-mail]>]

Hi Alex -- you can get certificates from
https://www.ghsiss.com/v2x-certificates/, if you have a 1609.2/103 097
implementation. There's a java implementation of 1609.2/103 097 here:
https://github.com/pvendil/c2c-common. I can't vouch for its quality. A
number of companies (including mine) will license a C/C++ implementation to
you.

Note that C-ITS certificates aren't X.509 certificates with ITS extensions,
they're a completely different and incompatible format. Your X.509
libraries won't be any use for this.

Cheers,

William

On Fri, Mar 29, 2019 at 11:17 AM Alexandre Petrescu <
[e-mail]> wrote:

> I agree with the statements about deployment expectation and available
> commercial support, and with the existing sdos and sites asking for this
> draft.
>
> On my side, I work for a few small deployments as well.
>
> I need certificates now.
>
> Allow me to be specific about my case.
>
> I am in France: in order to obtain ITS-specific certificates I got
> redirected to a French enterprise named IDnomic.  It is a great company
> (presumably part of what you refer to as 'commercial support'). That has
> a website with ITS described as Object-ID
> https://www.idnomic.com/object-id/
>
> However, on that web page, there is no button to press to ask a
> certificate.  IDnomic is not like, let's say, I asked a certificate to
> Let's Encrypt.   Let's Encrypt can offer me certificates in an automated
> manner; and not least important - for free.
>
> On the downside, Let's Encrypt certificates are not specific for
> Vehicular networks.  (I suppose Let's Encrypt never heard about ITS
> extensions to certificates).
>
> In this situation, what I do in my deployments, is to generate our own
> certificates, and sign them by our own CAs created locally.  The cars
> and traffic lights connect to our own openvpn server; they understand
> each other, because under same authority.
>
> Yet, this situation is not something that can scale: I dont want more
> and more vehicles to connect to my server.  It risks becoming a single
> point of failure.
>
> As a side note, I take advantage of this discussion to ask whether there
> is software implementation, or howto, that allows me to generate easily
> certificates with ITS extensions described in this draft.
>
> I need these now (well, during the following months).
>
> Alex
>
> Le 29/03/2019 à 13:38, William Whyte a écrit :
> > Alex, these certs are going to be widely deployed, and there is good
> > commercial support for them. We have standards organizations and
> > deployment sites asking for this draft.
> >
> > Cheers,
> >
> > William
> >
> >
> > On Fri, Mar 29, 2019 at 8:37 AM Alexandre Petrescu
> > <[e-mail] <mailto:[e-mail]>>
> wrote:
> >
> >     draft-tls-certieee1609-02
> >
> >     draft-msahli-ipwave-ieee1609-00.txt
> >
> >
> >     The certificates are highly necessary for securing IP based
> >     communications in vehicle networks.
> >
> >     But the conditions of their use may prevent deployment.
> >
> >     - can I use an open source package to generate now a certificate
> >     with features of these drafts?
> >
> >     - is there a Certificate Authority that I can ask now to sign them?
> >
> >     - can I do these two things for free now?
> >
> >     Because in absence of these conditions, I am highly tempted to use
> >     openvpn and its associated free tools to generate my own CA and my
> >     own certificates to put in the cars I deal with.
> >
> >     I think in practice several people do just that.
> >
> >     I think it is a situation that needs to be prevented, because it
> >     means the drafts are not used.
> >
> >     Alex
> >
> >     _______________________________________________
> >     its mailing list
> >     [e-mail] <mailto:[e-mail]>
> >     https://www.ietf.org/mailman/listinfo/its
> >
> >
> >
> > --
> >
> > ---
> >
> > I may have sent this email out of office hours. I never expect a
> > response outside yours.
>


-- 

---

I may have sent this email out of office hours. I never expect a response
outside yours.