Subject: Re: [TLS] Call for acceptance on multi-stapling

From: Nico Williams <[email-masked]>
Date: Fri, 4 May 2012 16:58:54 -0500

On Tue, Apr 24, 2012 at 1:14 PM, Yoav Nir <[email-masked]> wrote:
> On Apr 24, 2012, at 5:39 PM, Nico Williams wrote:
>> On Tue, Apr 24, 2012 at 9:31 AM, Jean-Marc Desperrier <[email-masked]> wrote:
>>> They make time synchronization problems at lot more acute.
>>> This can be interpreted as "causing them to choke", I'd expect the scale of
>>> the problem to be larger than the one with false start.
>>
>> They don't have to be short-lived, just fresh.
>
> I don't understand the distinction. If a relying party (in our case, the browser) requires that certificates are at most 24 hours old (presumably calculated by subtracting the current time from the notBefore field), what difference does it make if the notAfter field is 5 years in the future?

You're right.  But you know, we're talking about freshness
requirements measured in days.  I don't care about clients whose
clocks are that far out of sync.  A client whose clock is way behind
current time would find many certs appear as post-dated -- a great
clue to tell the user to check the clock.  A client whose clock is way
ahead of current time would find many certs to be insufficiently
fresh, and if those certs had an extension indicating the intention to
use them only while fresh then that too would be a great clue to tell
the user to check the clock.

I think fresh certs have significant advantages over OCSP stapling.

Nico
-- 

Nico
--

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 6 May 2012 12:24:34 -0700

The chairs have gone over the list discussion and have concluded that there
is rough consensus to accept this document as a WG item.

We have asked Yngve to prepare a new draft and submit.

-Ekr
[For the chairs.]

On Wed, Apr 18, 2012 at 2:02 PM, Eric Rescorla <[email-masked]> wrote:
> WG members,
>
> At the meeting in Paris there was broad consensus to adopt Yngve's
> TLS Multi-Stapling draft
> (http://www.ietf.org/id/draft-pettersen-tls-ext-multiple-ocsp-03.txt).
>
> The WG chairs would like to confirm this consensus. Please send any
> comments by Wednesday April 25.
>
> -Ekr
> [For the chairs]