Re: [Rescert] Notes from RPKI security review

[Rob Austein <sra@hactrn.net>]

At Tue, 19 Jun 2007 14:51:11 -1000, Randy Bush wrote:
>
> > I've been using subjectAltName heavily for several years now and have
> > seen no problems.  Doesn't make you wrong, but OpenSSL and Apache
> > clearly can deal with it and I was assuming we'd support it in our
> > client and server code.
> 
> i occasionally get whacked by a client saying "you have a cert for foux
> when i want one for barre" when the cert has an altname of barre.

We're writing the clients, we can choose to get this right. :)

> >>> Also note that we don't currently say anything about CRLs in the
> >>> business PKI universe.
> >> not our business.  can't have parent reaching through child's irbe to
> >> biz key back end to check a crl.  irbes should check crls for the biz
> >> certs in their back ends, innuendo intended.
> > Mumble.  Agree about not reaching through somebody else's IRBE.  Had
> > been thinking of publishing CRLs via HTTP in some boring fashion, but
> > that has potential network partition issues.  I suspect you're right
> > but it seems a bit lame somehow.
> 
> A can not ask B's irbe to check the cert because that is trusting B,
> whose very cert you are trying to validate.

Cert contqains CRLDP (inserted by cert's issuer) telling me where to
look to find out if cert has been revoked.  Whom am I trusting that I
should not be trusting, and what makes you think I'm trusting
anybody's IRBE?