Subject: [stir] stir-certs-01: Certificate Expiration

From: Eric Burger <[email-masked]>
Date: Mon, 20 Apr 2020 13:31:41 -0400

One would expect trust anchors to remove old entries, but there is no guarantee. Russ asked if IANA could purge expired trust anchors from the registry. It’s not straightforward, although possible.

The current draft says, “IANA SHOULD remove a STIR trust anchor from the registry if the certificate expires."

Options I see:
1. Leave this as a SHOULD and IANA works it out when and if they work it out.
2. Make it a MUST and specify how IANA does the purge.
3. ???

TO DO
=====
1. Put in a mechanism for removing / updating entries. Proposal: whomever (domain) put in the entry can delete or modify the entry.

2. Add language that registry users are URGED (VERY STRONG MAY) to validate the trust anchor, like making sure the trust anchor has not expired.

---

From: Brian Rosen <[email-masked]>
Date: Mon, 20 Apr 2020 15:53:43 -0400

This is a mechanical check.  We could give IANA a tool. 

But it’s also something that just isn’t much of an issue.  Suppose it expired.  Then what?  Verification officially fails.  Verifiers could choose to use the expired certificate if they wanted.   Is removing the entry actually helpful?  I think not.

So I’d just delete the text, replacing it with "registrants MUST keep the registered data valid by updating it as needed".

Brian

> On Apr 20, 2020, at 1:31 PM, Eric Burger <[email-masked]> wrote:
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir