Subject: Re: [therightkey] review of draft-laurie-pki-sunlight-03: point 13

From: Ben Laurie <[email-masked]>
Date: Tue, 18 Dec 2012 12:19:43 +0000

> (13) 4.x - how does CT impact on the TLS server cert used for
> these HTTPS connections?

I presume you're afraid of some bootstrapping problem. So, let's
imagine a world in which no logs exist yet, but clients insist on CT
for all new certs. How do we get off the ground?

Easily: the log gets a cert from a CA _without_ an embedded SCT. It
then logs it (using an internal API) to get an SCT, which it serves
using a TLS extension.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 18 Dec 2012 23:03:12 +0000

On 12/18/2012 12:19 PM, Ben Laurie wrote:
> I presume you're afraid of some bootstrapping problem. 

Right. To be honest I still need to figure out that I agree
there's no gotcha there.

> So, let's

Ok, so do you need to say that clients interacting with a log
MUST be able to do CT and that CT SHOULD be used for such TLS
sessions?

S.

---

From: Ben Laurie <[email-masked]>
Date: Wed, 19 Dec 2012 10:33:54 +0000

> MUST be able to do CT and that CT SHOULD be used for such TLS

No, I don't think so, I'm saying that _if_ they do CT we can still bootstrap :-)