Re: [TLS] Last Call: RFC 2818 (HTTP Over TLS) to Proposed Standard

[[e-mail] (Martin Rex)]

Kyle Hamilton wrote:
> This is damaging, and I recommend against.  This is something which must
> be handled by HTTP and its demands of its transports, not TLS and its
> claim to support what it thinks its clients want.
> 
> Among other things, this RFC more than any other is responsible for the
> "Server Name Indication" requirement.  If it had not been the case,
> SNI would never have been necessary, and IESG/IETF would never have
> had to deal with it.

The RFC(s) responsible for the "Server Name Indication" requirement is/are
2068/2616 "HTTP/1.1", which introduced the concept of virtual hosting:

  http://tools.ietf.org/html/rfc2068#section-14.23
  http://tools.ietf.org/html/rfc2616#section-14.23


> 
> I suggest instead that it be moved to HISTORIC, and a 2818bis drafted
> which describes how the various TLS extensions play with HTTP.

While I would be OK with creating rfc2818bis that explicitly describes
additional requirements implied by the virtual hosting concept of HTTP/1.1
and refers to TLS extension SNI rfc4366 (for TLSv1.0+v1.1) and
rfc6066 (for TLSv1.2+),  I fail to see why we should move rfc2818
to historic _before_ such a 2818bis is ready for publication.


-Martin