[radext] Certficate and certificate chain selection (Was: Re: Review of draft-ietf-radext-radiusdtls)

[Heikki Vatiainen <[e-mail]>]

On Tue, 19 Mar 2024 at 23:27, Fabian Mauchle <fabian.mauchle=
[e-mail]> wrote:


> On 11.03.2024 14:57, Alan DeKok wrote:
> > 4.2.1.
> >
> >       ... Implementations SHOULD indicate their trusted Certification
> authorities (CAs).
> >
> >    Do RADUUS/TLS implementations do this today?
>


> radsecproxy does, on the server side. I.e. it will send the trusted CA
> list in the ServerHello, but the client side currently ignores it (since
> it can't handle multiple client certificates anyway).
>

I haven't seen certificate selection used on server or client side. My
initial reaction for this is that static configuration has worked fine so
far. Then again, when the use of RADIUS/TLS becomes more common, static
configuration may be too restrictive.

Therefore:
- If SHOULD level key word is kept for trusted CA list, does it apply for
both clients and servers?
- SHOULD implies that the receiver typically takes action when it receives
the list, yes?
- Related to CA list, should use of Server Name Indication (SNI) also be
discussed?
- At the moment, do we know what is good advice (secure, matches real
needs, ...)?

For example, there's text in the draft about 'clients configured by their
source IP address'. If such a client is creative with the CA list and SNI
options, would they be able establish a TLS connection they otherwise
wouldn't be able to?

-- 
Heikki Vatiainen
[e-mail]