[Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt

[Ran Atkinson <[e-mail]>]

If Tero’s approach is taken, then correct process means the OpenSSH maintainers explicit prior approval is needed — because it is using their namespace.

I think it is very worthwhile to have a documented approach for handling X.509 certs in SSH.  I’m indifferent on which particular approach is taken.  

Ran

> On Apr 27, 2026, at 14:12, Tero Kivinen <[e-mail]> wrote:
> 
> Simon Tatham writes:
>> A major purpose of this WG is to publish documents specifying things
>> that have been deployed in practice for many years, so that people
>> wanting to interoperate with existing implementations can find proper
>> documentation of how to do it.
> 
> It does not do that, or more exactly it does even more. My
> understanding is that the existing implementations use
> "[e-mail]" name not the "ssh-rsa-cert" name.
> 
> If we are just documenting the existing protocol, we should just do
> that and keep the @openssh.com namespace intact so we do get
> interoperability with the existing implementations. If we are defining
> new format "ssh-rsa-cert" then the specification should be open for
> modifications and discussion whether it is needed or not.
> 
> My proposal is to just do the first thing, i.e., document the existing
> "[e-mail]" format and keep those names.
> -- 
> [e-mail]
> 
> _______________________________________________
> Ssh mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]