Re: [TLS] draft-hallambaker-tlsfeature-02

[Nikos Mavrogiannopoulos <[e-mail]>]

On 05/28/2013 07:11 PM, Ben Wilson wrote:

> What if the CA / Browser Forum were to add an optional provision for the
> certificate profile of End Entity TLS Certificates that said the following?
> 
> TLS Feature Extension (optional)
> 
> Subscriber Certificates MAY contain the TLS Feature Extension advertising
> that the status_request feature of OCSP stapling is available and supported
> by the subscriber.  If present, this field MUST NOT be marked critical. 
> See http://tools.ietf.org/html/draft-hallambaker-tlsfeature-02 


What is the actual problem the TLS extension on this draft solves?
A client doesn't need an extension to drop the connection if an OCSP
reply cannot be obtained. Moreover there are very few cases where a
server would like to force the client to disconnect if such a reply is
not available since the CA's OCSP server is typically outside its
control, and which server administrator would like his site to go down
every time the CA's server goes down.

For the latter if the server is really concerned about the client
getting the OCSP replies, he can send them in-band anyway using the
status request extension (and if the server doesn't support this
extension - as mentioned in the draft - why would it support the new one?)

regards,
Nikos