Subject: [Doh] [Editorial Errata Reported] RFC8484 (6708)

From: RFC Errata System <[email-masked]>
Date: Wed, 13 Oct 2021 18:29:39 -0700 (PDT)

The following errata report has been submitted for RFC8484,
"DNS Queries over HTTPS (DoH)".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid6708

--------------------------------------
Type: Editorial
Reported by: Martin Thomson <[email-masked]>

Section: 10

Original Text
-------------
The use of Online Certificate
   Status Protocol (OCSP) [RFC6960] servers or Authority Information
   Access (AIA) for Certificate Revocation List (CRL) fetching (see
   Section 4.2.2.1 of [RFC5280]) are examples of how this deadlock can
   happen.

Corrected Text
--------------
The use of Online Certificate Status Protocol (OCSP) [RFC6960] servers, Certificate Revocation List (CRL) distribution points (see Section 4.2.1.13 of [RFC5280]), or Authority Information Access (AIA) to retrieve issuer certificates (see Section 4.2.2.1 of [RFC5280]) are examples of how this deadlock can happen.

Notes
-----
The OCSP part is fine, but the AIA piece is wrong.

For context, there are three different ways (to my knowledge) that a client might make outbound connections in order to validate or build a certification path.

1. CRL - clients fetch CRLs from the designated location.  This rarely happens any more as it is grossly inefficient, but it does still happen in some usages.

2. OCSP - clients query OCSP for the status of a certificate.

3.  AIA chasing - this is where the TLS handshake doesn't include the full set of certificates required to validate the end-entity certificate, but the certificate includes a URL for that certificate.

AIA itself is a multi-purpose field.  It can include multiple elements, one of which is the identity of an OCSP responder (the same one used in (2) above) and the other being the one used in (3).  It does not include CRL distribution points, as the text implies.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8484 (draft-ietf-doh-dns-over-https-14)
--------------------------------------
Title               : DNS Queries over HTTPS (DoH)
Publication Date    : October 2018
Author(s)           : P. Hoffman, P. McManus
Category            : PROPOSED STANDARD
Source              : DNS Over HTTPS
Area                : Applications and Real-Time
Stream              : IETF
Verifying Party     : IESG