[websec] Issue that came up about HSTS

[Yoav Nir <[e-mail]>]

Hi all

draft-ietf-websec-strict-transport-sec is now being edited by the RFC editor. An issue has come up. We need to resolve this quickly, so please read the following and reply to the list with your opinions.

Section 8.4 begins as follows:


8.4. Errors in Secure Transport Establishment

  When connecting to a Known HSTS Host, the UA MUST terminate the
  connection (see also Section 12 "User Agent Implementation Advice")
  if there are any errors, whether "warning" or "fatal" or any other
  error level, with the underlying secure transport.  For example, this
  includes any errors found in certificate validity checking UAs employ
  such as via Certificate Revocation Lists (CRL) [RFC5280], or via the
  Online Certificate Status Protocol (OCSP) [RFC2560].

The list of example ways that the UA employs to validate certificates includes CRLs and OCSP. The authors believe that the list should be extended to also include a reference to the succinctly-named RFC 6125 ("Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)"). See the below suggested text, the new stuff begins with "as well as" on the penultimate line.


8.4. Errors in Secure Transport Establishment

  When connecting to a Known HSTS Host, the UA MUST terminate the
  connection (see also Section 12 "User Agent Implementation Advice")
  if there are any errors, whether "warning" or "fatal" or any other
  error level, with the underlying secure transport.  For example, this
  includes any errors found in certificate validity checking UAs employ
  such as via Certificate Revocation Lists (CRL) [RFC5280], or via the
  Online Certificate Status Protocol (OCSP) [RFC2560], as well as via
  server identity checking [RFC6125]. 

Note that this is not an additional Last Call. If nobody strongly objects to this addition, we will add it. We have already heard from Barry that this addition is fine, and will not require a new LC.

Please respond soon, as the RFC editor is working on this document now.

Thanks

Yoav