Subject: R: CPS Pointer

From: Santoni Adriano <[email-masked]>
Date: Wed, 2 May 2001 11:50:42 +0200

I think that we should also explicitly provide for HTTPS, if that is not
obvious enough from the text and context.
Some CAs publish their CPS on an SSL-protected web site, so the user can
verify it comes from a trusted source (this is good practice, IMO).

Adriano

-----Messaggio originale-----
Da: [email-masked] [mailto:[email-masked]]
Inviato: martedì 1 maggio 2001 19.01
A: Housley Russ
Cc: [email-masked]
Oggetto: Re: CPS Pointer

I think the current text is fine.  I don't think there is any benefit in 
requiring or suggesting that CAs use particular forms of URIs.  This 
should be left as "a local matter".

Terry Hayes

Housley, Russ wrote:

> Trevor Freeman noticed we don't have any guidelines for what forms of 
> URI are supported with the CPS Pointer.  Presently, we say:
>
>    The CPS Pointer qualifier contains a pointer to a Certification
>    Practice Statement (CPS) published by the CA.  The pointer is in the
>    form of a URI.  Processing requirements for this qualifier are a
>    local matter.  No action is mandated by this specification regardless
>    of the criticality value asserted for the extension.
>
> So, we are not mandating any behavior on the client.  Perhaps we 
> should say something about the CA.  Trevor suggests that HTTP and FTP 
> forms of URI are sufficient.  Does anyone see any reason to support 
> other protocols for CPS fetching?
>
> Russ

*******************Internet Email Confidentiality Footer******************* 
Qualsiasi utilizzo non autorizzato del presente messaggio nonche' dei suoi
allegati e' vietato e potrebbe costituire reato. Se lei ha ricevuto
erroneamente il presente messaggio, Le saremmo grati se, via e-mail, ce ne
comunicasse la ricezione e provvedesse alla distruzione del messaggio stesso
e dei suoi eventuali allegati. Le dichiarazioni contenute nel presente
messaggio nonche' nei suoi eventuali allegati devono essere attribuite
esclusivamente al mittente e non possono essere considerate come trasmesse o
autorizzate da SIA S.p.A.; le medesime dichiarazioni non impegnano SIA
S.p.A. nei confronti del destinatario o di terzi. 
SIA S.p.A. non si assume alcuna responsabilita' per eventuali
intercettazioni, modifiche o danneggiamenti del presente messaggio e-mail. 

Any unauthorized use of this e-mail or any of its attachments is prohibited
and could constitute an offence. If you are not the intended addressee
please advise immediately the sender by using the reply facility in your
e-mail software and destroy the message and its attachments. The statements
and opinions expressed in this e-mail message are those of the author of the
message and do not necessarily represent those of SIA. Besides, The contents
of this message shall be understood as neither given nor endorsed by SIA
S.p.A.. 
SIA S.p.A. does not accept liability for corruption, interception or
amendment, if any, or the consequences thereof.