Re: Request for well-known URI: est

[Barry Leiba <[e-mail]>]

(Correcting the CC list; please only reply to this one...)

> I'd like to request a review of registration request for
> .well-known/est, which is found in
> https://datatracker.ietf.org/doc/draft-ietf-pkix-est/.
>
> Summary: EST (Enrollment over Secure Transport) is a way for clients to
> retrieve PKI-related "stuff" from an EST server.  Think posting
> enrollment requests (i.e., PKCS#10), getting enrollment responses (i.e.,
> PKCS#7 certs-only), re-enrollment, CA certificates, etc.
>
>
> A related question, which I'm hoping you might be able to help with:
> when specifying the URI bit below our soon-to-be wellknown URI do we
> need to specify whether they are case sensitive or not?  For example, we
> have:
>
> /.well-known/est/CACerts
>
> but would that only be the same as the following if we state that it's
> case insensitive:
>
> /.well-known/est/cacerts

Well, RFC 5785 says this:

   Registered names MUST conform to the segment-nz production in
   [RFC3986].

And RFC 3986 says this:

      segment-nz    = 1*pchar
...
      pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

This is part of the "path" portion of the URI, which is case-sensitive.

You would need to register all case combinations that you intend to
use.  If you register "CACerts", then "cacerts" would not match.  If
you register "CACerts" *and* "cacerts", then "CACERTS" would not
match.

You need to pick one.  It would be a bad idea to register multiple
similar ones.  I suggest registering the all-lower-case version,
"cacerts".

Probably, 5785 should have declared well-known names to be
case-insensitive, but it didn't.  I suspect that the designated
experts would not accept registrations for different uses for names
that differ only in case.

Barry