Subject: Re: [dane] #31: Multiple TLSA records in a response

From: "yzw_iplab" <[email-masked]>
Date: Wed, 31 Aug 2011 08:48:00 +0800

Hi, 
Absolutely, it is useful for a domain to have more than one TLSA record. It may be used by the client for the flexible selection of server’s certificate. However, I think this is not necessary in the certificate update and the TLSA update process may follow:
1)
Initially, the old TLSA record is maintained in the DNS:
_123._tcp.example.com IN TLSA <old>
TLS server has certificate chain associated with <old>.
2)
Certificate should be updated and the old TLSA record is replaced:
_123._tcp.example.com IN TLSA <new>
While the TLS server should maintain both old and new certificates for some time:
TLS server has certificate chain associated with <old>.
TLS server has certificate chain associated with <new>.
3)
After the timeout, the old certificate is deleted from TLS server:
_123._tcp.example.com IN TLSA <new>
TLS server has certificate chain associated with <new>.
J
Sincerely yours,
Zhiwei Yan

2011-08-31 

yzw_iplab

---

From: Jakob Schlyter <[email-masked]>
Date: Thu, 1 Sep 2011 07:20:10 +0200

> TLS server has certificate chain associated with <new>.

My typical TLS server implementation does not support multiple concurrent certificates, and I'm pretty sure that's common.

Would you see any drawbacks with the more (previously discussed) traditional approach?

1. generate new certificate, publish both old and new TLSA RR in DNS
2. replace old with new certificate at TLS server
3. remove old TLSA RR from DNS

(with the appropriate waiting period for DNS caching timeout in between the steps of course)

	jakob