Re: [pkix] [saag] (it updates RFC 2585) New Version Notification for draft-seantek-certfrag-02.txt

[Sean Leonard <[e-mail]>]

Hello:

On Sep 8, 2015, at 11:32 AM, Paul Lambert <[e-mail]> wrote:

> 
> 
> 
>> Sean has asked me if I'd be ok with AD sponsoring this one. While it
>> seems reasonable as a thing one might want to do, I haven't seen that
>> it is something anyone else wants to use so I'm not convinced for now.
> 
> The application and semantics of this RFC is unclear.  The only text
> describing a use case is:
> 	"For example, a user agent may wish to draw
> 	attention to the "notAfter" time for an
> 	expired certificate.²
> 
> 
> This seems broken in that the semantics of any one field needs to include
> a notion of the validity of the certificate.

Not really, or at least, that was not the intent. notAfter is just a field in the certificate. The purpose of the example was to motivate a use case, namely, if the certificate is expired in some validation context, the user agent can generate a URI like:

view-source://internal/checkcert?cert=foo#na

so that the modular certificate viewing component can highlight that particular data field.

An equally potent example could be given if the certificate is valid, to highlight when the certificate expires. Yet another example could be given is nobody has done a validation check; the user agent just wants to point out the notAfter time.

To reduce confusion, I can change that sentence to:
“For example, a user agent may wish to draw attention to the "notAfter" field of a certificate.”

-Sean