Re: [netconf] WGLC on draft-ietf-netconf-tls-client-server

[Kent Watsen <[e-mail]>]

Hi Dhruv,

>> - I am wondering if anything needs to be done for the older versions of TLS which are made historic. The use of features helps, is there any other guidance that needs to be given?
> 
> We could set the “status” to “deprecated”.  That said, it's one thing to say that a protocol is deprecated and another to say that the configuration for a still somewhat widely-used deprecated-protocol is deprecated…thoughts?
> 
> 
> 
> I agree that we need to allow the configuration of older TLS versions in the YANG module. 
> 
> I found this comment from Ben to be useful - https://mailarchive.ietf.org/arch/msg/last-call/oVO7XyHyTtX4bdkpN9PymiovieA/ <https://mailarchive.ietf.org/arch/msg/last-call/oVO7XyHyTtX4bdkpN9PymiovieA/>  . I ended up putting MD5 and SHA-1 support under a feature 'deprecated’.

Wait, you put the support under a feature called “deprecated” or under a deprecated feature (called something else?



> In this case, I think just adding some text in the description around the existing features for older TLS could also do the job.  


That’s easy enough.  For each feature except 1.3, I added to the “description” statement:

    "Please note that TLS 1.? is obsoleted and thus it is NOT
     RECOMMENDED to enable ths feature.”

Is it what you had in mind?

K.