Subject: [pkix] Cert Enroll Requirement: Browser integration

From: Anders Rundgren <[email-masked]>
Date: Wed, 06 Apr 2011 23:19:04 +0200

This is probably the biggest problem of all.

Being a dare-devil (in this context NB...) I therefore put a "Yes, of course" in my take on this subject :-)

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Wed, 6 Apr 2011 15:43:27 -0600

We want the protocol to be reasonable to implement by a lot of clients - browsers included. 

As such building on the protocol stack specified in the EST draft is my recommendation. A specific point is the text about server authentication with specifically calls put the browser/www authentication model (checking the subjectname as specified by a 3rd part certificate). 

See requirement I2 in the other thread. (yes, these will be in the next draft). 

- max

On Apr 6, 2011, at 3:19 PM, "Anders Rundgren" <[email-masked]> wrote:

> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Anders Rundgren <[email-masked]>
Date: Thu, 07 Apr 2011 06:11:47 +0200

On 2011-04-06 23:43, Max Pritikin (pritikin) wrote:
> As such building on the protocol stack specified in the EST draft is my recommendation.

No matter what stack we are talking about it will be a very hard sale.

Personally, I don't think you get anywhere without donating code
because the browser vendors are not following SDOs on this
matter; they run their own enrollment agendas.
These agendas are currently secret, not even their mere existence is acknowledged.

How come?  I think it is because the browser is gradually
becoming the operating system which means that browsers
will be used in 95% of all plausible use cases for enrollment
of certificates to humans.

Browsers also make protocols simpler since user authentication
can be left out from the protocol (auth is done in the web layer).

Anders

 A specific point is the text about server authentication with specifically calls put the browser/www authentication model (checking the subjectname as specified by a 3rd part certificate).