Subject: Status of draft-ietf-pkix-certstore-http?

From: Jack Lloyd <[email-masked]>
Date: Tue, 20 Apr 2004 10:11:47 -0400

The last version of this draft I can find is -05, expiring in September
2003. Has this draft been abandoned, or is going to start moving again at some
point?

-Jack

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 21 Apr 2004 12:56:39 +1200

Jack Lloyd <[email-masked]> writes:

>The last version of this draft I can find is -05, expiring in September 2003.
>Has this draft been abandoned, or is going to start moving again at some
>point?

A number of people have been asking that :-).  The current draft was
mistakenly deleted from the IETF server, I'll get a new version up within the
next few days, although I'm not sure what number it'll have because of the
missing (deleted) copy.  For all intents and purposes it's identical to -05,
there's just two minor wording changes.

Peter.

---

From: Jack Lloyd <[email-masked]>
Date: Wed, 21 Apr 2004 10:22:10 -0400

> there's just two minor wording changes.

Good to hear. Is there a public server anywhere I can hit with requests?  Or,
better, a server implementation I can run locally with various strange test
certs?

-J

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 23 Apr 2004 15:40:12 +1200

Jack Lloyd <[email-masked]> writes:

>Is there a public server anywhere I can hit with requests?  Or, better, a
>server implementation I can run locally with various strange test certs?

Not that I know of.  There are several implementations, but I don't know if
any of their users would want them being hit with arbitrary requests from the
net, or if they're even visible on the net.  OTOH doing an implementation
using (say) a web-enabled database takes almost no time, there's a MySQL-
based one that was supposedly done in about 30 minutes, it's just a case of
mapping the portions of an incoming URI to a "SELECT FROM certificates WHERE
$URI_key_portion = $URI_value_portion", for various values of
$URI_key_portion.  I did a (fairly minimal) C one in about 2 pages of code
(this is based on a much older version of the spec which does multiple-cert
responses as a PKCS #7 cert chain rather than a multipart response, among
other things), and there's a JDBC one as well... I'll see if I can get the
code for that publicised. Actually since the person who wrote it reads this
list: Any chance of posting the code?

It also depends on what you want to test, if all you want to check is the
ability to grab certs via HTTP, you can just put some certs at a fixed
location on a web server, since the client can't tell the difference between
static and dynamic content.  That's how I first tested the client-side code
years ago.

Send me private mail if you want the implementation I did.  Generally it'd be
publicly available, but I've been re-doing some unrelated portions of the code
recently and it's not really fit to be released yet.

Peter.