Subject: Re: [Capwap] Comments on Cert Management

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 6 Nov 2006 16:54:09 -0800 (GMT-08:00)

Hi David,

David T Perkins wrote:
>To be complete, the CAPWAP proto spec or a companion
>document MUST support and describe management of
>X.509 certs. It must be specified how to replace or
>augment the original cert placed in a WTP during
>the manufacturing process. How to recover if WTP
>cert or the CA cert used by the WTP has expired.
>How to add additional CA certs on the WTP (and
>remove old ones).

I think we've had this discussion before - I still can't agree with this. Certificate management is extremely complex. The IPsec working group punted this for a number of years for that very reason, and they ultimately formed a separate working group to deal with the associated issues. They are nearing closure, but they're still not done after several years.  I think we should rely on preshared keys for interoperability initially, and defer the problem of fully specifiying certificate management. It's not critical for interoperability, and we shouldn't hold up the base specification for this.

I do agree that it's important, just not that it has to be addressed before we standardize a minimal necessary and sufficient interoperable capwap core.

Scott

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "David T. Perkins" <[email-masked]>
Date: Mon, 6 Nov 2006 17:10:44 -0800 (PST)

HI,

While, techincally you can get DTLS to work with preshared
keys, I don't believe that this would be a deployment
scenario.

I believe that you are making the issue of cert
management way much harder than what is needed.

The big issue is that CAPWAP needs a limited bit
of cert management. It doesn't need a complete
cert management protocol. What is the smallest
set of operations do you see that we can get
by with?

On Mon, 6 Nov 2006, Scott G. Kelly wrote:
> I think we've had this discussion before - I still can't
> agree with this. Certificate management is extremely complex.
> The IPsec working group punted this for a number of years
> for that very reason, and they ultimately formed a separate
> working group to deal with the associated issues. They are
> nearing closure, but they're still not done after several
> years.  I think we should rely on preshared keys for 
> interoperability initially, and defer the problem of 
> fully specifiying certificate management. It's not critical
> for interoperability, and we shouldn't hold up the base
> specification for this.
> 
> I do agree that it's important, just not that it has to be
> addressed before we standardize a minimal necessary and
> sufficient interoperable capwap core.
> 
> Scott
> 
Regards,
/david t. perkins