Subject: Re: [dane] #36: Only requiring DNSSEC where it is needed

From: "dane issue tracker" <[email-masked]>
Date: Thu, 15 Dec 2011 13:00:00 -0000

#36: Only requiring DNSSEC where it is needed

Changes (by ondrej.sury@…):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 Consensus was reached on incorporating following text into the draft:

 An application that complies with this document first requests TLSA
 records in order to make certificate associations.

 Determining whether a TLSA RRset can be used depends
 on the DNSSEC validation state (as defined in [RFC4033]).

 o A TLSA RRset whose DNSSEC validation state is secure MUST be used
   as a certificate association for TLS unless a local policy would
   prohibit the use of the specific certificate association in the
   secure TLSA RRset.

 o If the DNSSEC validation state on the response to the request
   for the TLSA RRset is bogus, this MUST cause TLS not to be started
   or, if the TLS negotiation is already in progress, to cause
   the connection to be aborted.

 o A TLSA RRset whose DNSSEC validation state is indeterminate or
   insecure cannot be used for TLS and MUST be marked as unusable.

-- 
----------------------------+-----------------------------------------
 Reporter:  paul.hoffman@…  |       Owner:  draft-ietf-dane-protocol@…
     Type:  defect          |      Status:  closed
 Priority:  major           |   Milestone:
Component:  protocol        |     Version:
 Severity:  -               |  Resolution:  fixed
 Keywords:                  |
----------------------------+-----------------------------------------

Ticket URL: <http://wiki.tools.ietf.org/wg/dane/trac/ticket/36#comment:2>
dane <http://tools.ietf.org/dane/>