Subject: Re: [dane] A browser's myopic view redux: DNSSEC stapled self-signed X.509 certificates

From: =JeffH <[email-masked]>
Date: Sat, 25 Jun 2011 17:59:51 -0700

"Richard L. Barnes" <[email-masked]> said:
 >
 >
 > - These certs have subject==issuer=="DNSSEC Signed".  That breaks RFC 6125
 > rather badly, but since the certs are self-signed maybe that's not a big
 > deal.

it doesn't break RFC 6125 at all because self-signed certs are explicitly 
out-of-scope for RFC 6125. see..

<http://tools.ietf.org/html/rfc6125#section-1.7.2>	[4th bullet]

 > - The DNSSEC information is held in a certificate extension.  The format of
 > this extension would be a nice PKIX draft.

indeed.

=JeffH

---

From: Peter Saint-Andre <[email-masked]>
Date: Sat, 25 Jun 2011 19:54:33 -0600

+1 to what Jeff said.

On 6/25/11 6:59 PM, =JeffH wrote:
> it doesn't break RFC 6125 at all because self-signed certs are
> explicitly out-of-scope for RFC 6125. see..
>