Subject: session with expired certificate

From: Hallvard B Furuseth <[email-masked]>
Date: Fri, 6 Jun 2003 14:46:32 +0200

The thread about the bindDN being deleted reminded me of something:

What happens if the client or server certificate expires during the
session?  Should the session revert to 'unknown' auth state, as was
suggested in the bindDN thread?  Should the server or client (depending
on which certificate expired) close the TLS session, if any?

BTW, is this the same as if the bindDN names a strongAuthenticationUser
and binds with its certificate, or is that a third case?

-- 
Hallvard

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Fri, 06 Jun 2003 09:04:12 -0700

>on which certificate expired) close the TLS session, if any?

I think this is really a TLS issue.  From an LDAP perspective,
the TLS layer generates a closure alert and we proceed from
there.  Requirements for implementations to generate a TLS
alert in such cases should be stated in TLS specifications.
If not adequately covered already, you might comment to the
TLS WG.  They are currently revising RFC 2246.

>and binds with its certificate, or is that a third case?

LDAP does not support the X.511 "strong" method.

Kurt

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Fri, 6 Jun 2003 18:29:31 -0700 (PDT)

On Fri, 6 Jun 2003, Kurt D. Zeilenga wrote:

> I think this is really a TLS issue.  From an LDAP perspective, the TLS
> layer generates a closure alert and we proceed from there.
> Requirements for implementations to generate a TLS alert in such cases
> should be stated in TLS specifications. If not adequately covered
> already, you might comment to the TLS WG.  They are currently revising
> RFC 2246.

I don't think it's something either TLS or LDAP specifications should
specify (except maybe as a Security Consideration, please supply text if
you want something said).  This is really a server (or client) policy
issue.  In general there is no necessary relation between the duration of
a session established with a credential and the validity period of the
credential itself.  My Kerberos ticket expired an hour ago (which means
I've been at work too long), but the IMAP session in which I'm reading
this mail continues.

 - RL "Bob"