Subject: Re: Request for well-known URI: est

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 15 Aug 2013 13:22:53 -0600

On 4/16/13 9:22 AM, Sean Turner wrote:
> Hi wellknown-uri experts!
> 
> I'd like to request a review of registration request for
> .well-known/est, which is found in
> https://datatracker.ietf.org/doc/draft-ietf-pkix-est/.
> 
> Summary: EST (Enrollment over Secure Transport) is a way for clients to
> retrieve PKI-related "stuff" from an EST server.  Think posting
> enrollment requests (i.e., PKCS#10), getting enrollment responses (i.e.,
> PKCS#7 certs-only), re-enrollment, CA certificates, etc.
> 
> 
> A related question, which I'm hoping you might be able to help with:
> when specifying the URI bit below our soon-to-be wellknown URI do we
> need to specify whether they are case sensitive or not?  For example, we
> have:
> 
> /.well-known/est/CACerts
> 
> but would that only be the same as the following if we state that it's
> case insensitive:
> 
> /.well-known/est/cacerts

I know this I-D was just approved for publication, but I have a question
about the well-known URI registration. The document registers only the
"est" suffix. However, the document itself uses a number of well-known
URIs, such as the one that Sean mentioned above:

/.well-known/est/cacerts

And so on:

/.well-known/est/csrattrs
/.well-known/est/simpleenroll
[etc.]

By my reading of RFC 5785, each well-known URI would need to be
registered separately.

However, in a later reply within this thread (which I don't have
archived in my mail client), Mark Nottingham said the following
(seemingly as the designed expert for this registry):

"Each well-known controls the name space "below" it, so you can do what
you like there (within the constraints of URIs)."

http://www.ietf.org/mail-archive/web/wellknown-uri-review/current/msg00082.html

RFC 5785 says:

   Applications that wish to mint new well-known URIs MUST register
   them, following the procedures in Section 5.1.

   For example, if an application registers the name 'example', the
   corresponding well-known URI on 'http://www.example.com/' would be
   'http://www.example.com/.well-known/example'.

RFC 5785 does *not* say:

   For example, if an application registers the name 'example' then the
   corresponding well-known URIs on 'http://www.example.com' would be
   any URI starting with 'http://www.example.com/.well-known/example',
   such as 'http://www.example.com/.well-known/example-foo' or
   'http://www.example.com/.well-known/example/foo' or
   'http://www.example.com/.well-known/example/foo/bar'

IMHO clarification would be helpful here.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Thu, 15 Aug 2013 20:31:31 +0000

Peter,

RFC5785 also says: 

>    [the registration] MAY also contain additional information, such as the syntax of
>    additional path components, query strings and/or fragment identifiers
>    to be appended to the well-known URI, or protocol-specific details
>    (e.g., HTTP [RFC2616] method handling).

The 'cacert' and other things are additional path components as specified in the EST draft. 

I agree it would be useful to clarify if somebody could come along later and define a .well-known location such as "/.well-known/est/somethingNew". By my reading this "tree", if you will, starts at .well-known/est and thus any such attempted registration should fail due to the conflict. 

- max

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 15 Aug 2013 14:50:25 -0600

On 8/15/13 2:31 PM, Max Pritikin (pritikin) wrote:
> 
> Peter,
> 
> RFC5785 also says:
> 
>> [the registration] MAY also contain additional information, such as
>> the syntax of additional path components, query strings and/or
>> fragment identifiers to be appended to the well-known URI, or
>> protocol-specific details (e.g., HTTP [RFC2616] method handling).
> 
> 

Yes, they are. But they're not specified in the IANA registration request.

Now, that's not really the fault of the EST draft at some level, because
RFC 5785 doesn't make it clear how to specify such things in the
registration template.

> I agree it would be useful to clarify if somebody could come along
> later and define a .well-known location such as
> "/.well-known/est/somethingNew". By my reading this "tree", if you
> will, starts at .well-known/est and thus any such attempted
> registration should fail due to the conflict.

So it seems. It's kind of like URN namespaces: we're setting up an
authority of some sort for everything below "/.well-known/est" but we're
really not saying how that authority needs to operate. IMHO this is a
gap in RFC 5785...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 23 Aug 2013 13:10:33 +1000

> really not saying how that authority needs to operate. IMHO this is a

If you want to delegate / control the name space below the space you register in well known, that's up to you; 5785 is purposefully silent about it, because you might decide to use an IANA registry for that, or you might decide to use the DNS, or use a UUID, or...

Cheers,

--
Mark Nottingham   http://www.mnot.net/