Subject: Re: [Trans] [trans] #39 (client-behavior): Monitor behavior

From: "trans issue tracker" <[email-masked]>
Date: Tue, 22 Dec 2015 16:31:34 -0000

#39: Monitor behavior

Comment (by [email-masked]):

 The following text should replace Section 9.3, so that the Monitor
 function is described in a way consistent with earlier comments about
 Monitors in this doc, and in a way that does not include Auditor
 functionality. The algorithm described in this section should be moved to
 an Appendix.

 A Monitor observes a set of logs to detect certificate mis-issuance.  A
 Monitor notifies a Subject (TLS server) when a mis-issued certificate has
 been  issued on behalf of that Subject. Every CT-aware Subject ought to
 either perform self-Monitoring or arrange with a third-party Monitor to
 detect mis-issued certificates on behalf of the Subject. A CA might
 performing monitoring on behalf of the Subjects to which it issue
 certificates, an important example of third-party monitoring.

 A Monitor performs its function by examining all entries from a set of
 logs that it observes and comparing these entries to reference data for a
 set of one or more Subjects. (The reference data consists, at a minimum,
 of a list of Subject and Subject Alternative Names and the pubic key
 information associated with each, supplied by the Subject.) If a Monitor
 detects a log entry for a certificate that is inconsistent with the
 reference data for a Subject, the Monitor notifies the Subject.
 Requirements for the Monitor function will be provided in a document to be
 publish later.

-- 
-----------------------------+-----------------------
 Reporter:  [email-masked]     |       Owner:
     Type:  defect           |      Status:  reopened
 Priority:  major            |   Milestone:
Component:  client-behavior  |     Version:
 Severity:  -                |  Resolution:
 Keywords:                   |
-----------------------------+-----------------------

Ticket URL: <https://trac.tools.ietf.org/wg/trans/trac/ticket/39#comment:6>
trans <https://tools.ietf.org/trans/>