Subject: Re: [dane] #31: Multiple TLSA records in a response

From: [email-masked]
Date: Fri, 2 Sep 2011 23:05:36 +0000

On Wed, Aug 17, 2011 at 03:43:29PM -0000, dane issue tracker wrote:
> #31: Multiple TLSA records in a response
> 
> Comment(by paul.hoffman@b&):
>  Proposal: in section 4.4, add a short paragraph that says "A domain name can have more than one TLSA record. A typical use for multiple TLSA records would be when the site is changing from one certificate to another. If a DNS response contains multiple TLSA records, any record from the set returned can be used to make certificate associations."
> -- -----------------------------------+---------------------------------------- Reporter:  paul.hoffman@b&         |       Owner:  draft-ietf-dane-protocol@b&                  Type:  defect                 |      Status:  new                                     Priority:  major                  |   Milestone:                                         Component:  protocol               |     Version:                                          Severity:  -                      |    Keywords:                                         -----------------------------------+----------------------------------------
> Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/31#comment:1>dane <http://tools.ietf.org/dane/>
> _______________________________________________dane mailing [email-masked]://www.ietf.org/mailman/listinfo/dane

	any is too ambigious.  what are the tie breaker rules?

/bill

---

From: "dane issue tracker" <[email-masked]>
Date: Wed, 14 Sep 2011 21:00:54 -0000

Changes (by warren@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Summary:
 Consensus for this text (edits from Bill Manning):

 On the first match between one of the certificate association(s) and the
 server's end entity certificate in TLS is found, the TLS client continues
 the
 TLS handshake, ignoring remaining certificate associations. If no match
 between the usable certificate association(s) and the server's end entity
 certificate in TLS is found, the TLS client MUST abort the handshake with
 an
 "access_denied" error.

 There was discussion on the MUST, input from Martin Rex in
 http://www.ietf.org/mail-archive/web/dane/current/msg03341.html

 Longer text:
 http://www.ietf.org/mail-archive/web/dane/current/msg03354.html

-- 
-----------------------------------+----------------------------------------
 Reporter:  paul.hoffman@…         |        Owner:  draft-ietf-dane-protocol@…             
     Type:  defect                 |       Status:  closed                                 
 Priority:  major                  |    Milestone:                                         
Component:  protocol               |      Version:                                         
 Severity:  -                      |   Resolution:  fixed                                  
 Keywords:                         |  
-----------------------------------+----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/31#comment:9>
dane <http://tools.ietf.org/dane/>