Subject: Re: netscape-cert-renewal-url & beyond

From: Russ Housley <[email-masked]>
Date: Sun, 01 Apr 2007 11:46:41 -0400

Such an extension is suitable for publication as an informational 
RFC, unless change control is released to the IETF, in which case a 
standards-track RFC is possible if there is sufficient 
interest.  That said, it does nothing to help a relying party.  It 
helps the subject of the certificate, but this same information could 
be provided to the subject when the certificate is issued without 
burdening all of the parties that make use of the certificate.

Russ

At 02:32 AM 3/31/2007, Anders Rundgren wrote:

>Although the "netscape-cert-renewal-url" certificate extension does
>not appear to be incorporated in any PKIX RFC, it is anyway
>documented in vendor specs like:
>http://msdn2.microsoft.com/en-us/library/aa378149.aspx
>
>I have two open questions regarding this particular extension:
>
>1. Is it supported by any PKI-clients and if so which ones?
>
>2. If it is not already supported on major scale wouldn't it be
>worthwhile supporting such a facility?  My personal experience
>with certificates (I have had numerous), is that they tend to silently
>expire, leaving you high and dry and concluding that "passwords are
>better".   When you have to "renew" from scratch you are thrown
>into laborious processes which can take weeks to perform.
>
>If you have certificate and key in a connected device
>like a web-server or mobile phone, you could very well
>create something like we already have with Windows update,
>JRE update, Adobe update, where the user in some instances
>only would have to issue a PIN in order to get a credential
>update.   For commercial certificates the process would be
>slightly more complex but of course an auto-renewal-process
>must support this use-case as well.
>
>I do not propose making the Netscape extension a PKIX
>standard but rather start discussing the road to a better
>support of credential life-cycles.
>
>Comments?
>
>Anders Rundgren

---

From: Russ Housley <[email-masked]>
Date: Sun, 01 Apr 2007 15:16:11 -0400

Anders:

> >It helps the subject of the certificate, but this same information
> >could be provided to the subject when the certificate is issued
>
>Ehh? When the certificate is "issued"?  I think you need to
>elaborate a bit on what you had in mind preferably fitting the 10M
>and counting consumer/citizen certificate holders in the EU.

At the time the CA provides the certificate to the subject, they 
could provide the URL for renewal.  It does not need to be in the 
certificate itself.  It just needs to be available to the subject 
when they want to renew.

> >without burdening all of the parties that make use of the certificate.
>
>How could a relying party be "burdened" by a non-critical extension
>it may not understand and definitely do not have to care for?

It is information for the subject, it has no value to the relying 
party.  The extension makes the certificate larger, so it takes more 
bandwidth, which remains an important consideration in some parts of 
the Internet.

Russ

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 1 Apr 2007 21:08:25 +0200

>Russ Housley wrote:
<snip>

Anders