Subject: [TLS] fyi: draft-saintandre-tls-server-id-check

From: =JeffH <[email-masked]>
Date: Wed, 30 Jun 2010 20:21:12 -0700

Martin Rex <[email-masked]> wrote..
 >
 > ... Unless it is clearly defined how things should
 > work with protocols (rfc-2818 or draft-saintandre-tls-server-id-check)
 > this approach is going to create new problems, because it completely
 > ignores programmatic clients.

Thanks for pointing out this I-D Martin...

   http://tools.ietf.org/html/draft-saintandre-tls-server-id-check

The notion(s) of cert validity (being referenced in this thread) are fairly 
squishy it seems (e.g. lack of thoroughly concise widely-referenced 
specifications (yes we're aware of the EVcert guidelines)) and are context 
dependent. We're trying to firm up things up for at least a significant chunk 
of contexts, and feedback is appreciated..

                                       ... Please send feedback to the
    editors directly or post to the <[email-masked]> mailing list, for
    which archives and subscription information are available at
    <https://www.ietf.org/mailman/listinfo/certid>.

As being presently thrashed about on the certid@ list, the notion of "DNS name 
'matching' the 'name' in the presented server cert" is unfortunately a complex 
one -- thus if one wants to look at Ivan's study data in detail, in particular 
the name matching portion, one would need to know precisely the matching 
algorithm used.

=JeffH