Subject: RE: [Sip] SIP/TLS (1): Domain certificates in SIP

From: "Peterson, Jon" <[email-masked]>
Date: Wed, 5 Apr 2006 05:12:08 -0400

In sip-identity-06 (13.4), we defer the whole CN/SAN issue to RFC 2818:

   A verifier MUST evaluate the correspondence between the user's
   identity and the signing certificate by following the procedures
   defined in RFC 2818 [11] Section 3.1.  While RFC2818 deals with the
   use of HTTP in TLS, the procedures described are applicable to
   verifying identity if one subtitutes the "hostname of the server" in
   HTTP for the domain portion of the user's identity in the From header
   field of a SIP request with an Identity header.

Essentially, the rules in RFC2818 state that SAN is used if present, and if not present, the most specific CN is used. We follow RFC2818 so that we'll have the closest correspondence to the practices of web certificate authorities for traditional TLS usage. We should probably update the canonical RFC3261 procedures to do the same.

Regarding name subordination, again, I think the guidance in sip-identity-06 13.4 is the best text we have today. "Virtual hosting" scenarios are discussed in that text, and the ramifications of the design of RFC3263 on virtual hosting configurations are explicitly laid out. I suspect the text there is the best starting place for establishing rules for how domain certificates are understood in SIP.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Vijay K. Gurbani [mailto:[email-masked]]
> Sent: Tuesday, April 04, 2006 2:12 PM
> To: Cullen Jennings
> Cc: [email-masked]
> Subject: Re: [Sip] SIP/TLS (1): Domain certificates in SIP
> 
> 
> Cullen Jennings wrote:
> > I don't understand the DNS name would refer to a host or conversely
> > why the SIP name does not. Either can refer to either. I don't see
> > the need for distinction - the cert needs to refer to the name used
> > to reach the proxy - that is typically called the "domain" but may
> > refer to a single host or many.
> 
> If the "domain" refers to many hosts, then is the cert shared among
> all the hosts?  Or does each host have a different cert with the same
> domainname in SAN but a unique serial number?
> 
> If a cert only has a SAN of DNS:proxy-1.example.com" is the intent,
> then that proxy-1 is the authority for example.com?  Then, if another
> cert has a SAN of "DNS:proxy-1.south.example.com" is the intent that
> proxy-1 is the authority for south.example.com zone AND example.com
> zone?
> 
> > I see no need to step into any CN disasters - they are very hard to
> > specify and we have no backwards compatible need to do it. SIP has
> > been SAN from the beginning.
> 
> OK.  Thanks for the clarification.
> 
> However, in rfc3261, SAN is only mentioned in connection with S/MIME
> certs (section 23.2).  For TLS certs, rfc3261 simply says "Proxy
> servers, redirect servers, and registrars SHOULD possess a site
> certificate whose subject corresponds to their canonical hostname".
> It is probably the intent that the "subject" in that sentence refer
> to SAN; but it is not clear from simply reading the sentence that
> this is indeed the intent.
> 
> Thanks,
> 
> - vijay
> -- 
> Vijay K. Gurbani  vkg@{lucent.com,research.bell-labs.com,acm.org}
> Bell Laboratories, Lucent Technologies, Inc.
> 2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip