Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

From: "Dave Engberg" <[email-masked]>
Date: Thu, 9 Feb 2006 13:24:48 -0500

Was there any technical reason for this?

I can't think of another use of HTTP that has a hard-coded URI suffix
requirement.  It would be like web browsers refusing to render HTML pages
unless they came from a URI ending in ".htm".  It seems that the canonical
HTTP type selection mechanism is the "content-type" header, not the
characters in the URI.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Thursday, February 09, 2006 1:03 PM
To: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

It seems fine to me also from security and interoperability viewpoint.

But, it seems to violate the following text in 3280 Biz:

"When the HTTP or FTP scheme is specified, the
   URI MUST point to a CRL file.  The CRL file MUST contain a single DER
   encoded CRL (indicated by the .crl file extension) as specified in
   [RFC 2585]."

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Tom Gindin
Sent: Thursday, February 09, 2006 8:45 AM
To: Wen-Cheng Wang
Cc: [email-masked]
Subject: Re: [RFC 3280 ] valid URL syntax for CRL?

        RFC 4387 explicitly recommends URL's of approximately that format to
retrieve CRL's as well as certs, such as:  
http://www.some-ca.com/cgi-bin/get-crl?sHash=abcDEF1234567890 (although that
argument would actually be 27 characters long, with the trailing equal sign
from base 64 conversion omitted).
        This particular form is not ambiguous, and there seems no reason it
would not be used in a DP extension.
 
                Tom Gindin

"Wen-Cheng Wang" <[email-masked]>
Sent by: [email-masked]
02/08/2006 09:08 PM
 
        To:     <[email-masked]>
        cc: 
        Subject:        Re: [RFC 3280 ] valid URL syntax for CRL?

Can't it be a URL pointing to a CGI that return a CRL file (with correct
MIME type, of course)?
For example:
   http://www.some-ca.com/cgi-bin/get-crl.exe?partition=101
 
Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.
 
Pointing to the location is not enough when using http. The filename must be
specified.
RFC3280bis is made clearer on this point.
 
The reason is simple. Just pointing to the location may not be unambiguous
since many crl files may reside there.
Then there is a practical one. We don?t want to put the burden on the cert
validation logic to figure out what file is intended.
 
Stefan Santesson
Program Manager, Standards Liaison
Windows Security

From: Michael Lursen
Sent: den 8 februari 2006 16:34
To: Santosh Chokhani; Riho Raassild; [email-masked]; Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Stefan?

From: Santosh Chokhani [mailto:[email-masked]]
Sent: Wednesday, February 08, 2006 4:33 PM
To: Michael Lursen; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
May be I am missing something.  Can you not simply invoke the HTTP and get
the file?

From: Michael Lursen [mailto:[email-masked]]
Sent: Wednesday, February 08, 2006 10:23 AM
To: Santosh Chokhani; Riho Raassild; [email-masked]
Cc: Stefan Santesson
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
So you are saying that we must accept this type of URL?

From: Santosh Chokhani [mailto:[email-masked]]
Sent: Wednesday, February 08, 2006 4:25 PM
To: Riho Raassild; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
If directory is a file that contains the CRL, it is fine. I assume that the
file resides the filesystem root of the Web Server.

From: Riho Raassild [mailto:[email-masked]]
Sent: Wednesday, February 08, 2006 10:15 AM
To: Santosh Chokhani; Michael Lursen; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi Santosh

Does it mean that http://www.domain.com/directory/ is wrong, based on this
RFC, even it points to a file?

BR 

Riho 

From: Santosh Chokhani [mailto:[email-masked]]
Sent: Wednesday, February 08, 2006 5:18 PM
To: Michael Lursen; [email-masked]
Cc: Riho Raassild
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
I agree that option A pointing to the file is the correct one.

From: [email-masked] [mailto:[email-masked]] 
On Behalf Of Michael Lursen
Sent: Wednesday, February 08, 2006 8:36 AM
To: [email-masked]
Cc: [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi,
 
Can someone please follow up on this email? 
 
Thanks,
Michaël Lürsen.

From: Michael Lursen 
Sent: Monday, January 30, 2006 10:14 AM
To: [email-masked]'
Cc: Edwin Burgstede; [email-masked]'
Subject: [RFC 3280 ] valid URL syntax for CRL? 
 
Hi,
 
Can someone please tell me which of these URL?s is valid as a URL to a CRL 
Distribution point:
 
A.)    http://www.domain.com/directory/list.crl
B.)    http://www.domain.com/directory/
 
I think only url A is valid, according to the following line from RFC 
3280:
 
?If the cRLDistributionPoints extension contains a general name of type 
URI, the following semantics MUST be assumed: the URI is a pointer to the 
current CRL for the associated reasons and will be issued by the 
associated cRLIssuer.?
 
It is possible to use default document handling to forward URL B to a 
file. Should this type of URL be accepted?
 
Thanks in advance.
 
Kind regards,
Michaël Lürsen |
 
PS, please use reply all.

---

From: "santosh chokhani" <[email-masked]>
Date: Thu, 9 Feb 2006 14:17:30 -0500

David,

Your question is best answered by the editors of 3280.  I am simply trying
to ensure that I am reading 3280 correctly.  Am I?

-----Original Message-----

                Tom Gindin

        To:     <[email-masked]>
        cc: 

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL? 

Santosh is correct.

 
Stefan Santesson

From: Michael Lursen
 
Stefan?

 

 
Hi Santosh

BR 

Riho 

 
Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen 
 
Hi,

 

 
Thanks in advance.
 
Kind regards,
Michaël Lürsen |

---

From: "Ryan Hurst" <[email-masked]>
Date: Sun, 12 Feb 2006 18:57:50 -0800

Thanks for all the feedback.

Our thinking has been exactly what David and Santosh called out bellow, however on David's last point we were hesitant to introduce a new extension indicating that "the server who produced the response doesn't support nonces" as we were shooting for a profile of 2560 vs creation of a new protocol as we did not want to compatibility.

I have spoken with Alex and although we don?t know of any precedence of a profile of an existing protocol referring to a future version of a protocol in this way, we understand the intent of the statement and are OK with the change you call out, e.g:

"Future versions of the OCSP protocol may provide a way for the client to know whether the server supports nonces or does not support nonces.
If a client can determine that the server supports nonces, it MUST reject a reply that does not contain the expected nonce.
Otherwise, clients that opt to include a nonce in the request SHOULD NOT reject a corresponding OCSPResponse solely on the basis of the non-existent expected nonce, but MUST fall back to validating the OCSPResponse based on time."

I will be working on a revision of the draft tomorrow with the editorial changes from Steve (thanks) and will include this new text in the same revision.

Ryan

________________________________

From: [email-masked] on behalf of Dave Engberg
Sent: Thu 2/9/2006 10:24 AM
To: Santosh Chokhani; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

-----Original Message-----

                Tom Gindin

        To:     <[email-masked]>
        cc:

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Santosh is correct.

Stefan Santesson

From: Michael Lursen

Stefan?

Hi Santosh

BR

Riho

Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen

Hi,

Thanks in advance.

Kind regards,
Michaël Lürsen |

---

From: "Ryan Hurst" <[email-masked]>
Date: Mon, 13 Feb 2006 07:54:06 -0800

Its been brought to my attention responded to the wrong thread, my bad :(

From: [email-masked] on behalf of Ryan Hurst
Sent: Sun 2/12/2006 6:57 PM
To: Dave Engberg; Santosh Chokhani; [email-masked]
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Our thinking has been exactly what David and Santosh called out bellow, however on David's last point we were hesitant to introduce a new extension indicating that "the server who produced the response doesn't support nonces" as we were shooting for a profile of 2560 vs creation of a new protocol as we did not want to break compatibility.

Ryan

-----Original Message-----

                Tom Gindin

        To:     <[email-masked]>
        cc:

Wen-Cheng Wang
----- Original Message -----
From: Stefan Santesson
To: Michael Lursen ; Santosh Chokhani ; Riho Raassild ; [email-masked]
Sent: Thursday, February 09, 2006 1:39 AM
Subject: RE: [RFC 3280 ] valid URL syntax for CRL?

Santosh is correct.

Stefan Santesson

From: Michael Lursen

Stefan?

Hi Santosh

BR

Riho

Hi,

Thanks,
Michaël Lürsen.

From: Michael Lursen

Hi,

Thanks in advance.

Kind regards,
Michaël Lürsen |