Subject: [pkix] AD Review of draft-ietf-pkix-rfc5280-clarifications-03.txt

From: Sean Turner <[email-masked]>
Date: Mon, 22 Aug 2011 08:52:47 -0400

I think the -03 version is just about ready to go.  That is I have no 
comments on the existing text though I expect getting it through the 
IESG will be interesting (Apps ADs love to discuss about anything to do 
with characters strings/sets).  But, I think this draft needs to also 
address the issue of self-signed EE certificates.  I know at least the 
DANE WG had a lengthy discussion about self-signed EE certificates, I 
see that Max's EST draft also includes them, and they're used in the 
wild.  I want to see text included that addresses them.

spt

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 22 Aug 2011 08:08:26 -0700

On Aug 22, 2011, at 5:52 AM, Sean Turner wrote:

> I think the -03 version is just about ready to go.  That is I have no comments on the existing text though I expect getting it through the IESG will be interesting (Apps ADs love to discuss about anything to do with characters strings/sets).  But, I think this draft needs to also address the issue of self-signed EE certificates.  I know at least the DANE WG had a lengthy discussion about self-signed EE certificates, I see that Max's EST draft also includes them, and they're used in the wild.  I want to see text included that addresses them.

+1. Given that this document already updates, not just clarifies, RFC 5280, it would be a great place to state exactly how PKIX will handle self-signed non-CA certificates in the future. David's terse writing style will be an extra bonus here.

Even if the above doesn't happen, the name of the document needs to be changed from "Clarifications to..." to "Updates to..." since both of the current sections are listed as updates, not clarifications.

--Paul Hoffman