Re: [TLS] Update spec to match current practices for certificate chain order

[Viktor Dukhovni <[e-mail]>]

On Thu, May 07, 2015 at 02:35:15PM -0400, Dave Garrett wrote:

> Current:  https://tools.ietf.org/html/rfc5246#section-7.4.2
> 
> certificate_list requirements draft 3a:
> ------------------------------------------------------------
>   certificate_list
>      This is a list of certificates needed for authentication.
>      The sender's certificate MUST come first in the list.
>      Additional certificates needed to construct a valid certificate
>      chain SHOULD be ordered by increasing scope of authority.
>      (e.g. sender, intermediate(s), certificate authority)
>      Root certificate authority certificates MAY be omitted from
>      this list under the assumption that the peer possesses it
>      in its trust store.
> ------------------------------------------------------------

That's mostly fine (singular/plural conflict), though one might
clarify the MAY further:

  certificate_list
     This is a list of certificates needed for authentication.
     The sender's certificate MUST come first in the list.  Additional
     certificates needed to construct a valid certificate chain
     SHOULD be ordered by increasing scope of authority.  (e.g.
     sender, intermediate(s), certificate authority).  Root
     certificate authority certificates MAY be omitted from the
     list, provided supported peers are known to possesses any
     omitted certificates they may require in their trust stores.
     (When DANE-TA(2) trust-anchors are self-signed roots, they
     MUST not be omitted [draft-ietf-dane-ops]).

Note, [draft-ietf-dane-ops] will be an RFC long before TLS 1.3 is
done.

> certificate_list requirements draft 3b:
> ------------------------------------------------------------
>   certificate_list
>      This is a list of certificates needed for authentication.
>      The sender's certificate MUST come first in the list.
>      Additional certificates needed to construct a valid certificate
>      chain SHOULD be ordered by increasing scope of authority.
>      (e.g. sender, intermediate(s), certificate authority)
>      It is NOT RECOMMENDED to include root certificates that
>      peers must already possess in order to validate the
>      given chain.
> ------------------------------------------------------------

I think, that's still too strong.  Note that often the chain
construction is done by a library that augments the server leaf
certificate  with additional certificaets from the server's trust
store, and this code does not know whether the root is needed in
the chain or not.

-- 
	Viktor.