[pkix] Re: [Errata Held for Document Update] RFC5280 (8789)

[Deb Cooley <[e-mail]>]

It appears to be.  It does raise questions...  I'll ask what we should do.

Deb

On Tue, Mar 3, 2026 at 2:38 PM Corey Bonnell <Corey.Bonnell=
[e-mail]> wrote:

> I'm confused. Isn't this erratum a duplicate of the verified, technical
> erratum https://www.rfc-editor.org/errata/eid5802?
>
> -----Original Message-----
> From: RFC Errata System <[e-mail]>
> Sent: Tuesday, March 3, 2026 12:34 PM
> To: [e-mail]; [e-mail];
> [e-mail];
> [e-mail]; [e-mail]; [e-mail];
>
> [e-mail]
> Cc: [e-mail]; [e-mail]; [e-mail];
> [e-mail]
> Subject: [pkix] [Errata Held for Document Update] RFC5280 (8789)
>
> The following errata report has been held for document update for RFC5280,
> "Internet X.509 Public Key Infrastructure Certificate and Certificate
> Revocation List (CRL) Profile".
>
> --------------------------------------
> You may review the report below and at:
> https://www.rfc-editor.org/errata/eid8789
>
> --------------------------------------
> Status: Held for Document Update
> Type: Editorial
>
> Reported by: Elizabeth Peraza Slator <[e-mail]> Date
> Reported: 2026-02-28 Held by: Paul Wouters (IESG)
>
> Section: GLOBAL
>
> Original Text
> -------------
> Section 4.2.1.12 says:
>
>    id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>    -- TLS WWW server authentication
>    -- Key usage bits that may be consistent: digitalSignature,
>    -- keyEncipherment or keyAgreement
>
>    id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
>    -- TLS WWW client authentication
>    -- Key usage bits that may be consistent: digitalSignature
>    -- and/or keyAgreement
> It should say:
>
>    id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>    -- TLS server authentication
>    -- Key usage bits that may be consistent: digitalSignature,
>    -- keyEncipherment or keyAgreement
>
>    id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
>    -- TLS client authentication
>    -- Key usage bits that may be consistent: digitalSignature
>    -- and/or keyAgreement
> Notes:
>
> The proposed change removes the WWW part of the description. In practice
> these
> object identifiers are used for server and client applications, but not
> necessarily web applications. In particular:
> - openssl verification considers them unconditionally even if the server
> is
> not a web server or the client a web client
> - There is no object identifier that can be used for protocols like SMTP,
> IMAP, POP3, LDAP, radius, ...; in practice all these protocols are
> deployed
> with the identifiers for WWW
> - Standards like common criteria assume that these object identifiers are
> for
> generic server and clients [0].
>
> [0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1
>
> Report New Errata
>
> Corrected Text
> --------------
> Section 4.2.1.12 says:
>
>    id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>    -- TLS WWW server authentication
>    -- Key usage bits that may be consistent: digitalSignature,
>    -- keyEncipherment or keyAgreement
>
>    id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
>    -- TLS WWW client authentication
>    -- Key usage bits that may be consistent: digitalSignature
>    -- and/or keyAgreement
> It should say:
>
>    id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
>    -- TLS server authentication
>    -- Key usage bits that may be consistent: digitalSignature,
>    -- keyEncipherment or keyAgreement
>
>    id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
>    -- TLS client authentication
>    -- Key usage bits that may be consistent: digitalSignature
>    -- and/or keyAgreement
> Notes:
>
> The proposed change removes the WWW part of the description. In practice
> these
> object identifiers are used for server and client applications, but not
> necessarily web applications. In particular:
> - openssl verification considers them unconditionally even if the server
> is
> not a web server or the client a web client
> - There is no object identifier that can be used for protocols like SMTP,
> IMAP, POP3, LDAP, radius, ...; in practice all these protocols are
> deployed
> with the identifiers for WWW
> - Standards like common criteria assume that these object identifiers are
> for
> generic server and clients [0].
>
> [0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1
>
> Report New Errata
>
> Notes
> -----
> Sec AD (Paul Wouters): Changed to Editorial,  as the suggested changes are
> in
> an ASN.1 comment
>
> --------------------------------------
> RFC5280 (draft-ietf-pkix-rfc3280bis-11)
> --------------------------------------
> Title               : Internet X.509 Public Key Infrastructure Certificate
> and
> Certificate Revocation List (CRL) Profile
> Publication Date    : May 2008
> Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R.
> Housley, W. Polk
> Category            : PROPOSED STANDARD
> Source              : Public-Key Infrastructure (X.509)
> Stream              : IETF
> Verifying Party     : IESG
>
> _______________________________________________
> pkix mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>