IETF Logo Mail Archive

Re: [TLS] Update spec to match current practices for certificate chain order

Peter Gutmann <pgut001@cs.auckland.ac.nz> Sat, 09 May 2015 13:09 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9915D1ACD12 for <tls@ietfa.amsl.com>; Sat, 9 May 2015 06:09:26 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.91
X-Spam-Level:
X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ML7SAklbOXPr for <tls@ietfa.amsl.com>; Sat, 9 May 2015 06:09:24 -0700 (PDT)
Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 740141ACCD8 for <tls@ietf.org>; Sat, 9 May 2015 06:09:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=uoa; t=1431176964; x=1462712964; h=from:to:subject:date:message-id: content-transfer-encoding:mime-version; bh=sMFocGkAZzhIhx7R3K37XjPGTGDhDr4Lz7nBheM3tDE=; b=HnhjBc3sh5HxoVlt2rQ4tuEZuoQLSLEpekMNh19Ug/U80bvfmAW9kdpZ OAioTxorIdYSM+q+I330qcuNZECA/EJGSZskaP3nuW0lTtTal4zm4ILAJ i/JzHfqQo+ID5H8/8ZflC+IwsSX8p959zImKP+DYQSn3N8E9snUA9ad2E U=;
X-IronPort-AV: E=Sophos;i="5.13,396,1427713200"; d="scan'208";a="3893820"
X-Ironport-HAT: MAIL-SERVERS - $RELAYED
X-Ironport-Source: 130.216.4.112 - Outgoing - Outgoing
Received: from uxchange10-fe1.uoa.auckland.ac.nz ([130.216.4.112]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES128-SHA; 10 May 2015 01:09:15 +1200
Received: from UXCN10-TDC05.UoA.auckland.ac.nz ([169.254.9.151]) by uxchange10-fe1.UoA.auckland.ac.nz ([130.216.4.112]) with mapi id 14.03.0174.001; Sun, 10 May 2015 01:09:14 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: "<tls@ietf.org>" <tls@ietf.org>
Thread-Topic: [TLS] Update spec to match current practices for certificate chain order
Thread-Index: AdCKWVjP/Wn/1mVNQaGtvKPiHTh6MQ==
Date: Sat, 09 May 2015 13:09:14 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73AB019B05@uxcn10-tdc05.UoA.auckland.ac.nz>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [130.216.158.4]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/aEo-LhJisQwlJkh8GoVKhqZmVQo>
Subject: Re: [TLS] Update spec to match current practices for certificate chain order
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 May 2015 13:09:26 -0000

Martin Rex <mrex@sap.com> writes:

>And every sensibly managed public CA ought to refuse signing the same public
>key for different names/identities/attributes (i.e. issuing different certs
>with the same public key).

ITYM "No true Scotsman would sign the same public key for different
names/identities/attributes".

(Also, no sensibly managed public CA will issue certs for RFC 1918 addresses,
unqualified domain names, "localhost", nonexistent domains, obviously bogus
domains like "your.server.address.com", and so on, so the tens of thousands of
certs like this that have been issued by public CAs must be a figment of our
imagination).

Peter.

v2.23.0 | Report a Bug | By Email