Re: [stir] x5u

[Russ Housley <[e-mail]>]

Alex:

Yes, that is the naming convention that is customary.  I did not have time during ther meeting session to find one.

Russ


> On Mar 18, 2024, at 4:34 AM, Alec Fenichel <[e-mail]> wrote:
> 
> The “.cer” file extension is generally (though not always) used for DER certificate format, not PEM certificate format.
>  
> So the example x5u URL here <https://www.ietf.org/archive/id/draft-ietf-stir-certificates-ocsp-07.html#name-ocsp-staple-passport-elemen> should not end in “.cer”. It should end in “.pem”.
>  
> Sincerely,
>  
> Alec Fenichel
> Chief Technology Officer
> TransNexus <https://transnexus.com/>
> [e-mail] <mailto:[e-mail]>
> [phone] <tel:[phone]>
>  
> From: stir <[e-mail] <mailto:[e-mail]>> on behalf of Russ Housley <[e-mail] <mailto:[e-mail]>>
> Date: Monday, March 18, 2024 at 04:10
> To: IETF STIR Mail List <[e-mail] <mailto:[e-mail]>>
> Subject: [stir] x5u
> 
> RFC 5715 says:
> 
> 4.1.5.  "x5u" (X.509 URL) Header Parameter
> 
>    The "x5u" (X.509 URL) Header Parameter is a URI [RFC3986] that refers
>    to a resource for the X.509 public key certificate or certificate
>    chain [RFC5280] corresponding to the key used to digitally sign the
>    JWS.  The identified resource MUST provide a representation of the
>    certificate or certificate chain that conforms to RFC 5280 [RFC5280]
>    in PEM-encoded form, with each certificate delimited as specified in
>    Section 6.1 of RFC 4945 [RFC4945].  The certificate containing the
>    public key corresponding to the key used to digitally sign the JWS
>    MUST be the first certificate.  This MAY be followed by additional
>    certificates, with each subsequent certificate being the one used to
>    certify the previous one.  The protocol used to acquire the resource
>    MUST provide integrity protection; an HTTP GET request to retrieve
>    the certificate MUST use TLS [RFC2818] [RFC5246]; and the identity of
>    the server MUST be validated, as per Section 6 of RFC 6125 [RFC6125].
>    Also, see Section 8 on TLS requirements.  Use of this Header
>    Parameter is OPTIONAL.
> 
> And, RFC 4945 says:
> 
> 6.1.  Certificates
> 
>    Certificates MUST be Base64 [19] encoded and appear between the
>    following delimiters:
> 
>             -----BEGIN CERTIFICATE-----
>             -----END CERTIFICATE-----
> 
> An example of a file that uses this encoding is here:
> 
> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fenc%2Fverifybundle.pem&data=05%7C02%7Calec.fenichel%40transnexus.com%7C724b2ed462454d9dddd208dc4722d8cf%7C8e2972a2d21d49acb00518e8ceaadee3%7C0%7C0%7C638463462215154720%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=oH3HoYc03umYi%2Fh1CmpmDuggA3iY9xq%2BUkBgrTS3G2c%3D&reserved=0
> 
> Russ
> 
> _______________________________________________
> stir mailing list
> [e-mail] <mailto:[e-mail]>
> https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fstir&data=05%7C02%7Calec.fenichel%40transnexus.com%7C724b2ed462454d9dddd208dc4722d8cf%7C8e2972a2d21d49acb00518e8ceaadee3%7C0%7C0%7C638463462215164689%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=nMF1FshBEEtloICfHj3TZkmJhqWI9cNC7I0Cz5pX7o4%3D&reserved=0