[saag] PKIX - TLS Feature Extension

[Nikos Mavrogiannopoulos <[e-mail]>]

Hi,
 RFC7633 describes a PKIX certificate extension to indicate mandatory
to be present TLS extensions (called feature extensions in the text).
In particular this draft while generic, is mainly about requiring an
OCSP staple from the connecting server if the certificate mandates it.

However, the rfc text doesn't go into details on how to do that. My
understanding and as far as I've seen in practice certificates will
include a "Feature" extension containing integer 5 which is the OCSP
status request.

If the reading above is correct, how does this scale with
status_request_v2 (which has TLS extension ID 17)? How could the
certificate be used to indicate that the server can provide any of
these TLS extensions? Should both the numbers 5,17 be listed as TLS
features (which can also mean that both TLS extensions must be used),
or having 5 listed is sufficient?

regards,
Nikos