Re: [TLS] Status of X.509v3 TLS Feature Extension?

Phillip Hallam-Baker <hallam@gmail.com> Tue, 29 April 2014 22:17 UTC

MIME-Version: 1.0
In-Reply-To: <2A0EFB9C05D0164E98F19BB0AF3708C7130742B777@USMBX1.msg.corp.akamai.com>
References: <2A0EFB9C05D0164E98F19BB0AF3708C7120C61F669@USMBX1.msg.corp.akamai.com> <20140428180218.C805D1ACE1@ld9781.wdf.sap.corp> <m2r44hw86f.fsf@localhost.localdomain> <CF855F95.39E86%paul@marvell.com> <CAL9PXLzCOyi2eWF39+oj0uEFWoU4muYBNm3hRYuZ-vepPxgN+A@mail.gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C7130742B777@USMBX1.msg.corp.akamai.com>
Date: Tue, 29 Apr 2014 18:17:03 -0400
Message-ID: <CAMm+LwjNDWqM1jTQHOwGAoycEHZtU3Ta3-mon2uxHb_AeV+i=g@mail.gmail.com>
From: Phillip Hallam-Baker <hallam@gmail.com>
To: "Salz, Rich" <rsalz@akamai.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/vVCpIPZSNqEMxT8XhxTxbFtY038
Cc: Geoffrey Keating <geoffk@geoffk.org>, "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Status of X.509v3 TLS Feature Extension?
Precedence: list

On Tue, Apr 29, 2014 at 5:28 PM, Salz, Rich <rsalz@akamai.com> wrote:
>> It might well be that Must Staple is best done for just the leaf and that pushed CRLs are used for intermediate revocations.
>> That's the deployment model that I think is mostly likely.
>
> +1

If we revoke an intermediate that doesn't have a name constraint in
then I can't see how we would not be doing some pretty aggressive
pushing out of the CRL.

Name constraints might change that calculus at some point in the
future, but not for quite a long time.

-- 
Website: http://hallambaker.com/

[TLS] Status of X.509v3 TLS Feature Extension? Klemens Baum
Re: [TLS] Status of X.509v3 TLS Feature Extension? Tom Ritter
Re: [TLS] Status of X.509v3 TLS Feature Extension? Rob Stradling
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Rob Stradling
Re: [TLS] Status of X.509v3 TLS Feature Extension? Russ Housley
Re: [TLS] Status of X.509v3 TLS Feature Extension? Viktor Dukhovni
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Watson Ladd
Re: [TLS] Status of X.509v3 TLS Feature Extension? Viktor Dukhovni
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Viktor Dukhovni
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Viktor Dukhovni
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Viktor Dukhovni
Re: [TLS] Status of X.509v3 TLS Feature Extension? Nico Williams
Re: [TLS] Status of X.509v3 TLS Feature Extension? Adam Langley
Re: [TLS] Status of X.509v3 TLS Feature Extension? Martin Rex
Re: [TLS] Status of X.509v3 TLS Feature Extension? Martin Rex
Re: [TLS] Status of X.509v3 TLS Feature Extension? Stephen Checkoway
Re: [TLS] Status of X.509v3 TLS Feature Extension? Geoffrey Keating
Re: [TLS] Status of X.509v3 TLS Feature Extension? Peter Gutmann
Re: [TLS] Status of X.509v3 TLS Feature Extension? Stephen Checkoway
Re: [TLS] Status of X.509v3 TLS Feature Extension? Nico Williams
Re: [TLS] Status of X.509v3 TLS Feature Extension? Nico Williams
Re: [TLS] Status of X.509v3 TLS Feature Extension? Geoffrey Keating
Re: [TLS] Status of X.509v3 TLS Feature Extension? Rob Stradling
Re: [TLS] Status of X.509v3 TLS Feature Extension? Phillip Hallam-Baker
Re: [TLS] Status of X.509v3 TLS Feature Extension? Rob Stradling
Re: [TLS] Status of X.509v3 TLS Feature Extension? Paul Lambert
Re: [TLS] Status of X.509v3 TLS Feature Extension? Adam Langley
Re: [TLS] Status of X.509v3 TLS Feature Extension? Nico Williams
Re: [TLS] Status of X.509v3 TLS Feature Extension? Adam Langley
Re: [TLS] Status of X.509v3 TLS Feature Extension? Salz, Rich
Re: [TLS] Status of X.509v3 TLS Feature Extension? Nico Williams
Re: [TLS] Status of X.509v3 TLS Feature Extension? Phillip Hallam-Baker