Subject: [dane] Fixing the wording for the last paragraph of Section 4.4

From: Paul Hoffman <[email-masked]>
Date: Wed, 17 Aug 2011 08:17:47 -0700

Greetings again. Earlier, Jim said:
=====
3.  The text in para 6 of section 4.4 is very out of date.  It does not
discuss any certificate type except end-entity and states that if an
end-entity certificate is not found (i.e. you cannot do a trust anchor only
DANE record) then the handshake aborts
=====

The current text in the document is:

If a match between one of the certificate association(s) and the server's
end entity certificate in TLS is found, the TLS client continues the TLS
handshake. If no match between the usable certificate association(s) and the
server's end entity certificate in TLS is found, the TLS client MUST abort the
handshake with an "access_denied" error.

I propose the following fix:

If a match between one of the certificate association(s) and the server's
certificate chain in TLS is found, the TLS client continues the TLS
handshake. If no match between the usable certificate association(s) and the
server's certificate chain in TLS is found, the TLS client MUST abort the
handshake with an "access_denied" error.

Does that match what people would have expected?

--Paul Hoffman

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 17 Aug 2011 08:33:53 -0700

(Sorry, should have used the issue tracker; now is issue #30)

--Paul Hoffman

---

From: Warren Kumari <[email-masked]>
Date: Wed, 17 Aug 2011 14:49:00 -0400

> (Sorry, should have used the issue tracker; now is issue #30)

Thank you Paul!

W

> 
> --Paul Hoffman
> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane
>

---

From: "Jim Schaad" <[email-masked]>
Date: Wed, 17 Aug 2011 14:07:22 -0700

+1

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Paul Hoffman
> Sent: Wednesday, August 17, 2011 8:18 AM
> To: DANE WG
> Subject: [dane] Fixing the wording for the last paragraph of Section 4.4
> 
discuss any
> certificate type except end-entity and states that if an end-entity
certificate
> is not found (i.e. you cannot do a trust anchor only DANE record) then the
> handshake aborts =====
> 
end
> entity certificate in TLS is found, the TLS client continues the TLS
handshake.
> If no match between the usable certificate association(s) and the server's
> end entity certificate in TLS is found, the TLS client MUST abort the
handshake. If
> no match between the usable certificate association(s) and the server's
> certificate chain in TLS is found, the TLS client MUST abort the handshake
> with an "access_denied" error.
>