Subject: [Emu] Issue: Validation of server certificates in Section 5.3 of RFC 2716bis

From: Bernard Aboba <[email-masked]>
Date: Tue, 5 Jun 2007 21:41:48 -0700

I was looking at Section 5.3 in RFC 2716bis, and I noticed that while RFC 3280 conformant path validation is recommended for EAP-TLS servers, there is no such recommendation for EAP-TLS peers.  This seems odd. For example, Section 5.3 states:   Since the EAP-TLS server is typically connected to the Internet, it   SHOULD support validating the peer certificate using RFC 3280   [RFC3280] conformant path validation, including the ability to   retrieve intermediate certificates that may be necessary to validate   the peer certificate. For details, see [RFC3280] Section 4.2.2.1.There is no equivalent statement for EAP-TLS peers. I would propose the insert the following sentence in Section 5.3:   The EAP-TLS peer SHOULD support validating   the server certificate using RFC 3280 [RFC3280] conformant path   validation.

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: Ryan Hurst <[email-masked]>
Date: Tue, 5 Jun 2007 21:44:52 -0700

Yes, I noticed this recently too; I think thats a good addition.
 
Ryan

________________________________

From: Bernard Aboba [mailto:[email-masked]]
Sent: Tue 6/5/2007 9:41 PM
To: [email-masked]
Subject: [Emu] Issue: Validation of server certificates in Section 5.3 of RFC 2716bis

I was looking at Section 5.3 in RFC 2716bis, and I noticed that while RFC 3280 conformant path validation is recommended for EAP-TLS servers, there is no such recommendation for EAP-TLS peers.  This seems odd. 

For example, Section 5.3 states:

   Since the EAP-TLS server is typically connected to the Internet, it
   SHOULD support validating the peer certificate using RFC 3280
   [RFC3280] conformant path validation, including the ability to
   retrieve intermediate certificates that may be necessary to validate
   the peer certificate. For details, see [RFC3280] Section 4.2.2.1.

There is no equivalent statement for EAP-TLS peers. 

I would propose the insert the following sentence in Section 5.3:

   The EAP-TLS peer SHOULD support validating
   the server certificate using RFC 3280 [RFC3280] conformant path
   validation.

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 6 Jun 2007 11:10:40 -0700

Looks fine to me. Any particular reason why we emphasize 4.2.2.1?

Thanks,

Joe

> -----Original Message-----
> From: Ryan Hurst [mailto:[email-masked]] 
> Sent: Tuesday, June 05, 2007 9:45 PM
> To: Bernard Aboba; [email-masked]
> Subject: RE: [Emu] Issue: Validation of server certificates 
> in Section 5.3 ofRFC 2716bis
> 
> I was looking at Section 5.3 in RFC 2716bis, and I noticed 
> that while RFC 3280 conformant path validation is recommended 
> for EAP-TLS servers, there is no such recommendation for 
> EAP-TLS peers.  This seems odd. 
>

---

From: Ryan Hurst <[email-masked]>
Date: Wed, 6 Jun 2007 12:32:16 -0700

The 4.2.2.1 reference is in support of "including the ability to
retrieve intermediate certificates that may be necessary to validate";
this is particularly important in cases where a server sends only its
certificate, sends a incomplete chain or sends a incorrect chain but the
right leaf.

Ryan
-----Original Message-----
From: Joseph Salowey (jsalowey) [mailto:[email-masked]] 
Sent: Wednesday, June 06, 2007 11:11 AM
To: Ryan Hurst; Bernard Aboba; [email-masked]
Subject: RE: [Emu] Issue: Validation of server certificates in Section
5.3 ofRFC 2716bis

Thanks,

Joe

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 6 Jun 2007 13:04:54 -0700

Excellent! 

> Sent: Wednesday, June 06, 2007 12:32 PM
> To: Joseph Salowey (jsalowey); Bernard Aboba; [email-masked]
> The 4.2.2.1 reference is in support of "including the ability 
> to retrieve intermediate certificates that may be necessary 
> to validate"; this is particularly important in cases where a 
> server sends only its certificate, sends a incomplete chain 
> or sends a incorrect chain but the right leaf.
> 
> Ryan
> > Subject: [Emu] Issue: Validation of server certificates in 
> Section 5.3 
> > of RFC 2716bis
> > 
> > 
> that while 
> > RFC 3280 conformant path validation is recommended for EAP-TLS 
> > servers, there is no such recommendation for EAP-TLS peers.  This 
> > seems odd.
> >