Re: [Trans] Draft agenda

The part I proposed to put on the agenda was the general approach to
avoiding logging private subdomains.
Of the two proposed solutions in issue #20, only the 2nd option refers to
precertificates. We could still discuss the 1st one without discussing
precertificates at all.

There's the separate matter of precertificates and serial numbers. Given
the vibrant discussions around it on the list, it might as well be added to
the agenda.

On Mon, Feb 24, 2014 at 7:17 PM, Phillip Hallam-Baker <hallam@gmail.com>wrote:

> What exactly is a 'precertificate'. Either something is a cert or it is
> not.
>
> If it parses as an X.509v3 certificate then it is an X.509v3 certificate
> and thats an end to it.
>
> If it is not then it is probably a CSR which would seem to be the existing
> PKIX structure that fits its purpose.
>
>
>
>
> On Mon, Feb 24, 2014 at 1:21 PM, Ben Laurie <benl@google.com> wrote:
>
>> On 24 February 2014 17:52, Melinda Shore <melinda.shore@gmail.com> wrote:
>> > On 2/24/14 7:35 AM, Eran Messeri wrote:
>> >> I'll be happy to scribe half the session.
>> >
>> > Excellent - thank you.
>> >
>> >> As for the agenda, I'd like to suggest discussing handling of private
>> >> subdomains
>> >> <
>> https://code.google.com/p/certificate-transparency/issues/detail?id=20>.
>> >> IMHO while the suggestion in the issue makes sense , it'd benefit from
>> >> another review to make sure it would work as intended and covers all
>> >> cases CAs are concerned about.
>> >
>> > That one looks to me like a hairball.  Right now it's a MUST
>> > in 5280 that a serial number be unique for each certificate
>> > issued by a CA.
>>
>> Precertificates already share serial numbers with certificates. The
>> intent of 5280 is not violated by this practice, but perhaps needs
>> amending to permit it.
>>
>> _______________________________________________
>> Trans mailing list
>> Trans@ietf.org
>> https://www.ietf.org/mailman/listinfo/trans
>>
>
>
>
> --
> Website: http://hallambaker.com/
>