Re: Request for well-known URI: est

[Peter Saint-Andre <[e-mail]>]

On 4/16/13 9:22 AM, Sean Turner wrote:
> Hi wellknown-uri experts!
> 
> I'd like to request a review of registration request for
> .well-known/est, which is found in
> https://datatracker.ietf.org/doc/draft-ietf-pkix-est/.
> 
> Summary: EST (Enrollment over Secure Transport) is a way for clients to
> retrieve PKI-related "stuff" from an EST server.  Think posting
> enrollment requests (i.e., PKCS#10), getting enrollment responses (i.e.,
> PKCS#7 certs-only), re-enrollment, CA certificates, etc.
> 
> 
> A related question, which I'm hoping you might be able to help with:
> when specifying the URI bit below our soon-to-be wellknown URI do we
> need to specify whether they are case sensitive or not?  For example, we
> have:
> 
> /.well-known/est/CACerts
> 
> but would that only be the same as the following if we state that it's
> case insensitive:
> 
> /.well-known/est/cacerts

I know this I-D was just approved for publication, but I have a question
about the well-known URI registration. The document registers only the
"est" suffix. However, the document itself uses a number of well-known
URIs, such as the one that Sean mentioned above:

/.well-known/est/cacerts

And so on:

/.well-known/est/csrattrs
/.well-known/est/simpleenroll
[etc.]

By my reading of RFC 5785, each well-known URI would need to be
registered separately.

However, in a later reply within this thread (which I don't have
archived in my mail client), Mark Nottingham said the following
(seemingly as the designed expert for this registry):

"Each well-known controls the name space "below" it, so you can do what
you like there (within the constraints of URIs)."

http://www.ietf.org/mail-archive/web/wellknown-uri-review/current/msg00082.html

RFC 5785 says:

   Applications that wish to mint new well-known URIs MUST register
   them, following the procedures in Section 5.1.

   For example, if an application registers the name 'example', the
   corresponding well-known URI on 'http://www.example.com/' would be
   'http://www.example.com/.well-known/example'.

RFC 5785 does *not* say:

   For example, if an application registers the name 'example' then the
   corresponding well-known URIs on 'http://www.example.com' would be
   any URI starting with 'http://www.example.com/.well-known/example',
   such as 'http://www.example.com/.well-known/example-foo' or
   'http://www.example.com/.well-known/example/foo' or
   'http://www.example.com/.well-known/example/foo/bar'

IMHO clarification would be helpful here.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/