Re: [keyassure] I-D Action:draft-ietf-dane-protocol-05.txt

[Martin Rex <[e-mail]>]

Stephen Kent wrote:
> 
> At 3:05 PM +0100 2/23/11, Martin Rex wrote:
> >Jakob Schlyter wrote:
> >>
> >>  On 23 feb 2011, at 12.04, Ben Laurie wrote:
> >>
> >>  >         1 -- A PKIX end-entity certificate in DER encoding
> >>  >
> >>  >         2 -- A PKIX certification authority's certificate in DER encoding
> >>
> >>  I agree this is a reasonable clarification.
> >
> >If anything, I would really prefer something like
> >
> >    1 -- An end-entity X.509 certificate in ASN.1 DER encoding
> >
> >    2 -- A certification authority's X.509 certificate in ASN.1 DER encoding
> >
> 
> In the IETF, PKIX profiles X.509 for use with IETF security protocols,
> so it probably makes sense to stick with the PKIX label here. This is 
> certainly true for EE certs. For a self-signed cert used to convey 
> trust anchor material, we may need some additional/different text.


But this would imply that EE certs will have to be issued by commercial CAs.

I thought that one of the purposes of DANE was to allow server admins
to create their own certificate and distribute it through DNS(SEC) TLSA
records.

Maybe we should distinguish more types:

   1 -- An end-entity X.509 certificate in ASN.1 DER encoding

   2 -- A certification authority's X.509 certificate in ASN.1 DER encoding

   3 -- An end-entity PKIX certificate from the TLS X.509 PKI

   4 -- A certification authority's PKIX certificate from the TLS X.509 PKI

For (1), the client would match the server certificate with the TLSA
record and be done with it, for (3), besides matching the server certificate
with the TLSA record, the client is expected to perform a regular
certificate path validation.


-Martin