Re: [TLS] Update spec to match current practices for certificate chain order

["Ryan Sleevi" <[e-mail]>]

On Tue, May 12, 2015 12:14 pm, Martin Rex wrote:
>  there is no "shouldn't have done (3a)/(3b)".  They can simple create
>  that crossCA cert *NOW* and start distributing it, and things will
>  work just fine.

Again, that's an assumption about the possibilities of change that are not
bourne out by the realities of the PKI.

In a variety of circumstances, there are actively reasons why creating a
crossCA is *not* valid or will *not* resolve issues for clients. In
particular, issuing such a cross-CA may violate appropriate WebTrust or
ETSI guidelines that CAs are required to adhere to, or violate the CA's
own CP/CPS. I'm sure that's an invitation for more decrying, but it's the
reality we live in, and compared to the alternatives, it's actually a
*good* thing, even if it makes spec purity hard.

>  The problem with your original proposal is, that no *CORRECT* TLS
>  implementation will allow you to send such junk in a TLS Certificate
>  handshake message, so this will simply not be an option.

Not an option conforming with the TLS spec, I fully acknowledge.

But it's an area where a number of clients never implemented (again,
layering - it's more work and more attack surface to actually enforce that
requirement), and it's an area where a number of servers actively ignore
because "working for clients" is more important than theoretical spec
purity.

Which is sort of why we're here discussing this in the first place -
whether or not we want to acknowledge reality or not.

But I don't think we're making productive progress here, so it's probably
worth me bowing out. It does seem like we're at a fundamental and
ideological impasse with regards to path discovery, and while I can try to
convince you that RFC 4158-like behaviours are good for all clients, I
suspect neither this list nor this issue is the right medium for it.

I leave it up to the editors & chairs to evaluate consensus, the relevant
arguments for and against, and the behaviours of clients (both for and
against).