Subject: [dane] Suggested changes in Section A.1.1

From: "Jim Schaad" <[email-masked]>
Date: Mon, 15 Aug 2011 17:02:07 -0700

I believe that some operational comments should be added in at this point.

So I would like to see the following text added:

After Example #1 as part of the paragraph.

If the domain owners of sub5.example.com and sub6.example.com are different,
then changes in the TLSA records need to be propagated from one owner to the
other before a new certificate can be rolled out.

After Example #2 as part of the next paragraph.

No coordination is needed between the domain owners of sub5.example.com and
sub6.example.com when rolling out new TLSA records.

After Example #3 as part of the next paragraph.

If the domain owners of sub5.example.com and sub6.example.com are different,
then changes in the TLSA records need to be propagated from one owner to the
other before a new certificate can be rolled out.

Jim

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 16 Aug 2011 21:18:47 +0200

> other before a new certificate can be rolled out.

It is the administrator of the TLS server at sub6.example.com that needs to communicate new TLSA records to the DNS administrator of sub5.example.com. Even within the same domain, this might not be the same administrator.

	jakob

---

From: "Jim Schaad" <[email-masked]>
Date: Tue, 16 Aug 2011 13:16:06 -0700

Actually it could be the DNS administrator of sub5 giving a new certificate
to the TLS server at sub6.

Jim

> -----Original Message-----
> From: Jakob Schlyter [mailto:[email-masked]]
> Sent: Tuesday, August 16, 2011 12:19 PM
> To: Jim Schaad
> Cc: [email-masked]
> Subject: Re: [dane] Suggested changes in Section A.1.1
> 
> > If the domain owners of sub5.example.com and sub6.example.com are
> > different, then changes in the TLSA records need to be propagated from
> > one owner to the other before a new certificate can be rolled out.
> 
> It is the administrator of the TLS server at sub6.example.com that needs
to
> communicate new TLSA records to the DNS administrator of
> sub5.example.com. Even within the same domain, this might not be the same
> administrator.
> 
> 	jakob

---

From: Jakob Schlyter <[email-masked]>
Date: Tue, 16 Aug 2011 21:49:10 +0200

> to the TLS server at sub6.

It could be a lot of things and the only thing we know is that careful coordination are always needed for key rollovers.

	jakob