Subject: I-D Action: draft-ietf-httpbis-expect-ct-00.txt

From: [email-masked]
Date: Wed, 08 Feb 2017 11:11:11 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Hypertext Transfer Protocol of the IETF.

        Title           : Expect-CT Extension for HTTP
        Author          : Emily Stark
	Filename        : draft-ietf-httpbis-expect-ct-00.txt
	Pages           : 17
	Date            : 2017-02-08

Abstract:
   This document defines a new HTTP header, named Expect-CT, that allows
   web host operators to instruct user agents to expect valid Signed
   Certificate Timestamps (SCTs) to be served on connections to these
   hosts.  When configured in enforcement mode, user agents (UAs) will
   remember that hosts expect SCTs and will refuse connections that do
   not conform to the UA's Certificate Transparency policy.  When
   configured in report-only mode, UAs will report the lack of valid
   SCTs to a URI configured by the host, but will allow the connection.
   By turning on Expect-CT, web host operators can discover
   misconfigurations in their Certificate Transparency deployments and
   ensure that misissued certificates accepted by UAs are discoverable
   in Certificate Transparency logs.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-expect-ct/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-ietf-httpbis-expect-ct-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Ilari Liusvaara <[email-masked]>
Date: Wed, 8 Feb 2017 23:03:37 +0200

> 	Filename        : draft-ietf-httpbis-expect-ct-00.txt
 
Quick comments:

- Document contains refences [4] and [5], but there are only two numbered
  references (I presume these should be [1] and [2]).
- Could be useful to note why trying to embed this information to
  certificate would lead to deployment problems (CAs don't issue TLS
  feature 18 certificates nor certificates with new extensions).

-Ilari

---

From: Emily Stark <[email-masked]>
Date: Wed, 8 Feb 2017 16:56:03 -0800

>   feature 18 certificates nor certificates with new extensions).

Thanks. Addressed in
https://github.com/httpwg/http-extensions/commit/55b43a0ab49f7c2232ea059b516abc1c749820e4
and
https://github.com/httpwg/http-extensions/commit/41b501407f12a17c657e51727539bfdf1a09b9fe