Subject: [dane] #30: Better coverage for certificate association wording

From: "dane issue tracker" <[email-masked]>
Date: Wed, 17 Aug 2011 15:32:36 -0000

#30: Better coverage for certificate association wording

 Earlier, Jim Schaad said:
 =====
 3.  The text in para 6 of section 4.4 is very out of date.  It does not
 discuss any certificate type except end-entity and states that if an
 end-entity certificate is not found (i.e. you cannot do a trust anchor
 only
 DANE record) then the handshake aborts
 =====

 The current text in the document is:

 If a match between one of the certificate association(s) and the server's
 end entity certificate in TLS is found, the TLS client continues the TLS
 handshake. If no match between the usable certificate association(s) and
 the
 server's end entity certificate in TLS is found, the TLS client MUST abort
 the
 handshake with an "access_denied" error.

-- 
-----------------------------------+----------------------------------------
 Reporter:  paul.hoffman@…         |       Owner:  draft-ietf-dane-protocol@…             
     Type:  defect                 |      Status:  new                                    
 Priority:  major                  |   Milestone:                                         
Component:  protocol               |     Version:                                         
 Severity:  -                      |    Keywords:                                         
-----------------------------------+----------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/30>
dane <http://tools.ietf.org/dane/>

---

From: "dane issue tracker" <[email-masked]>
Date: Wed, 17 Aug 2011 15:33:00 -0000

Comment(by paul.hoffman@…):

 I propose the following fix:

 If a match between one of the certificate association(s) and the server's
 certificate chain in TLS is found, the TLS client continues the TLS
 handshake. If no match between the usable certificate association(s) and
 the
 server's certificate chain in TLS is found, the TLS client MUST abort the
 handshake with an "access_denied" error.

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/30#comment:1>
dane <http://tools.ietf.org/dane/>