[netconf] x509c2n:cert-to-name problem (was [netmod])

[Kent Watsen <[e-mail]>]

[moving this fork in the 'netmod' discussion to the 'netconf' list]


>> The "tls-server-parameters" container defines the certificates used to
>> authenticate the client's cert.  In many deployments, regardless how
>> the client cert is authenticated, the "client-identification" section only
>> needs to explain how to extract the "name" from the cert, a fingerprint
>> isn't needed to identify either the client's end-entity or some
>> intermediate cert.
> 
> Ok.  To me this sounds like you need a more complex^wsophisticated
> client identification mechansim than what a plain cert-to-name gives
> you.  I don't think there is anything wrong with the current
> cert-to-name grouping.  So let's continue this discussion in the
> netconf ML, where this model is being developed.

In an attempt to resolve this issue, I modified both ietf-netconf-server
and ietf-restconf-server as follows:

OLD:
        uses x509c2n:cert-to-name;

NEW:
        uses x509c2n:cert-to-name {
          refine "cert-to-name/fingerprint" {
            mandatory false;
            description
              "A 'fingerprint' value does not need to be specified
               when the 'cert-to-name' mapping is independent of
               fingerprint matching.  A 'cert-to-name' having no
               fingerprint value will match any client certificate
               and therefore should only be present at the end of
               the user-ordered 'cert-to-name' list.";
          }
        }


Kent // contributor