Re: [tram] Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-discovery-09: (with DISCUSS)

["Tirumaleswar Reddy (tireddy)" <[e-mail]>]

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]]
> Sent: Wednesday, August 31, 2016 9:11 PM
> To: The IESG <[e-mail]>
> Cc: [e-mail]; Simon Perreault
> <[e-mail]>; [e-mail]; [e-mail];
> [e-mail]
> Subject: Alexey Melnikov's Discuss on draft-ietf-tram-turn-server-discovery-
> 09: (with DISCUSS)
> 
> Alexey Melnikov has entered the following ballot position for
> draft-ietf-tram-turn-server-discovery-09: Discuss
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-tram-turn-server-discovery/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> In Section 9:
> 
> o  For certificate-based authentication, a pre-populated trust anchor
>       store [RFC6024] allows a TURN client to perform path validation
>       for the server certificate obtained during the (D)TLS handshake.
> 
>       If the client used a domain name to discover the TURN server, that
>       domain name also provides a mechanism for validation of the TURN
>       server.  The client MUST use the rules and guidelines given in
>       section 6 of [RFC6125] to validate the TURN server identity.
> 
> I am glad that you are referencing RFC 6125, but unfortunately you don't
> provide enough details. Please add details as specified in Section 3 of RFC
> 6125 to your document.

Sure, will add the following lines:
Certification authorities that issue TURN server certificates SHOULD support the DNS-ID and SRV-ID identifier types. TURN service providers SHOULD include the DNS-ID and SRV-ID identifier types in certificate requests.

-Tiru

> 
> 
>