Subject: [TLS] OCSP Stapling support mandatory in TLS 1.3?

From: Phillip Hallam-Baker <[email-masked]>
Date: Fri, 8 Nov 2013 09:56:59 -0800

I would like to use the TLS 1.3 update to require support for a number of
functions that are desperately needed but currently difficult to use due to
patchy support. Which is kind of what the point of a version upgrade is.

Chief on my list of 'must have' features is stapling support. All the
servers I have surveyed for WPKOPS support stapling.

What I would like to see is that a server always staple if there is an OCSP
distribution point advertised.

What I would settle for is that the server MUST understand the 'MUST
STAPLE' flag in a certificate and if it is present, provide the stapled
responses.

http://tools.ietf.org/html/draft-hallambaker-tlsfeature-02

The advantage of this approach is that it means much less confusion for our
customers. It is easier for them to check that they support TLS 1.3 than to
look at server versions (which we might not know about if it is a less used
server or some CDN thing).

-- 
Website: http://hallambaker.com/