Subject: Request for well-known URI: est

From: Sean Turner <[email-masked]>
Date: Tue, 16 Apr 2013 11:22:48 -0400

Hi wellknown-uri experts!

I'd like to request a review of registration request for 
.well-known/est, which is found in 
https://datatracker.ietf.org/doc/draft-ietf-pkix-est/.

Summary: EST (Enrollment over Secure Transport) is a way for clients to 
retrieve PKI-related "stuff" from an EST server.  Think posting 
enrollment requests (i.e., PKCS#10), getting enrollment responses (i.e., 
PKCS#7 certs-only), re-enrollment, CA certificates, etc.

A related question, which I'm hoping you might be able to help with: 
when specifying the URI bit below our soon-to-be wellknown URI do we 
need to specify whether they are case sensitive or not?  For example, we 
have:

/.well-known/est/CACerts

but would that only be the same as the following if we state that it's 
case insensitive:

/.well-known/est/cacerts

spt

---

From: Barry Leiba <[email-masked]>
Date: Tue, 16 Apr 2013 12:32:13 -0400

(Correcting the CC list; please only reply to this one...)

> but would that only be the same as the following if we state that it's

Well, RFC 5785 says this:

   Registered names MUST conform to the segment-nz production in
   [RFC3986].

And RFC 3986 says this:

      segment-nz    = 1*pchar
...
      pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"

This is part of the "path" portion of the URI, which is case-sensitive.

You would need to register all case combinations that you intend to
use.  If you register "CACerts", then "cacerts" would not match.  If
you register "CACerts" *and* "cacerts", then "CACERTS" would not
match.

You need to pick one.  It would be a bad idea to register multiple
similar ones.  I suggest registering the all-lower-case version,
"cacerts".

Probably, 5785 should have declared well-known names to be
case-insensitive, but it didn't.  I suspect that the designated
experts would not accept registrations for different uses for names
that differ only in case.

Barry

---

From: Sean Turner <[email-masked]>
Date: Tue, 16 Apr 2013 16:15:47 -0400

> that differ only in case.

Glad I asked.  I had comment in my not-yet provided set of AD review 
comments.  I'll add it there.

spt

---

From: Barry Leiba <[email-masked]>
Date: Tue, 16 Apr 2013 16:30:19 -0400

...
...
>> similar ones.  I suggest registering the all-lower-case version,

Oops... wait: I missed something.

You're not registering "cacerts"; you're registering "est".

As long as "est" is registered and specified in lower case, you could
theoretically specify whatever you want for sub-paths of that.  But...

...the well-known DEs will have to make the call about whether it's
appropriate to have sub-paths below the well-known name.  I think
that's not in line with the intent of ".well-known".

Barry

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Tue, 16 Apr 2013 20:21:19 +0000

Regarding the case sensitivity issue: I would have expected the registration to be case insensitive but... on well. I'm comfortable with the suggestion to make everything lowercase.

- max

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Tue, 16 Apr 2013 20:36:10 +0000

Barry,

Yes the registration is for "est". From RFC5785:

   [the registration] MAY also contain additional information, such as the syntax of
   additional path components, query strings and/or fragment identifiers
   to be appended to the well-known URI, or protocol-specific details
   (e.g., HTTP [RFC2616] method handling).

The 'caccerts' and other things are additional path components as specified in the EST draft. 

- max

---

From: Mark Nottingham <[email-masked]>
Date: Wed, 17 Apr 2013 11:03:48 +1000

Hi Sean,

Each well-known controls the name space "below" it, so you can do what you like there (within the constraints of URIs).

However (and with my expert hat off), many/most Web servers map from filesystems to URIs in a case-sensitive fashion, and pretty much all APIs don't make any accommodation for case normalisation, so making these path components case-insensitive would be seen by many as a counter-intuitive, and even fairly unfriendly thing to do. Personally, I wouldn't recommend it.

(hat back on) I'll take a look at the draft and get back to you.

Cheers,

On 17/04/2013, at 1:22 AM, Sean Turner <[email-masked]> wrote:

> I'd like to request a review of registration request for .well-known/est, which is found in https://datatracker.ietf.org/doc/draft-ietf-pkix-est/.
> 
> Summary: EST (Enrollment over Secure Transport) is a way for clients to retrieve PKI-related "stuff" from an EST server.  Think posting enrollment requests (i.e., PKCS#10), getting enrollment responses (i.e., PKCS#7 certs-only), re-enrollment, CA certificates, etc.
> 
> 
> A related question, which I'm hoping you might be able to help with: when specifying the URI bit below our soon-to-be wellknown URI do we need to specify whether they are case sensitive or not?  For example, we have:
> 
> /.well-known/est/CACerts
> 
> but would that only be the same as the following if we state that it's case insensitive:
> 
> /.well-known/est/cacerts
> 
> spt
> 
> _______________________________________________
> wellknown-uri-review mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/wellknown-uri-review

--
Mark Nottingham   http://www.mnot.net/

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Wed, 17 Apr 2013 01:20:01 +0000

Making each path element lowercase will not be a problem. 

- max