[Plants] Re: Call for adoption: draft-gray-plants-mtc-deploy-use-cases-01 (Ends 2026-10-02)

[Ilari Liusvaara <[e-mail]>]

On Wed, Sep 23, 2026 at 09:22:46PM +0000, John Gray wrote:
> 
> One challenge is how private PKI systems verify landmark certificates
> outside of browsers. That led to the landmark verifier concept. I
> agree there is enough material there for a separate draft, and I
> intend to move that detailed work out of this document in the next
> update.

An idea: Two new X.509 extensions:

- trust-anchor-ids (set of relative oid): If importing this as a trust
  anchor, add these to ClientHello/CertificateRequest TAI list.
- mtc-trusted-hashes (set of octet string): If importing this as a trust
  anchor, add these to trusted hashes list.

Then one can represent the log, including landmark state as a
certificate. Another service can handle updating those.

Maybe even chuck a CRL in there too...


> Another interesting use case is revocation, which is definitely
> going to continue to be needed in private PKI because keys usually
> live longer in private PKI.  We already have several ideas for how
> MTCs could help there.

There are also private PKI's that take revocation very seriously. Those
need something like OCSP. Delegated OCSP should work with MTCs.




-Ilari