[quicwg/base-drafts] Mandating use of CN-ID is not modern practice (#4769)

[Martin Thomson <[e-mail]>]

@kaduk's review of -http identified use of the subject:commonName field in validating server identity.

We should not elevate CN-ID to MUST.  In doing so, we invalidate what CABF has done: 7.1.4.2.2 clause a of the Baseline Requirements marks subject:commonName as deprecated and discouraged.

My understanding (which I can confirm) is that browsers do not use CN-ID (concretely, the CN field of the certificate subject) and so we might want to just mention the dNSName type of subjectAltName here.  We can *mention* that some clients might use subject:commonName, but that this is a deprecated practice.  This accounts for some of the older certificate validation code that still exists in some places.  Some of that does rely on the common name.

I realize that this likely breaks new ground for the RFC series, and it likely needs more discussion, but maybe we can keep up with the times with this document.

(I apologize for not having caught this earlier; I think that this is copied from elsewhere and that too needs a refresh.)

_Originally posted by @martinthomson in https://github.com/quicwg/base-drafts/pull/4767#discussion_r560635858_

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769