Subject: [Ipsec] SA Life time and Certificate expiration date

From: [email-masked]
Date: Fri, 25 Mar 2005 15:50:00 -0500

What shoud the IKE do if the user configure SA life time ( say 5 days) is more than the certificate remaining time (say, the certifcate will be expired in 3 days)? Should we pick the minimum of {the SA life time the user configured, the certificate remaining time}, or should we abort IKE and send audit to the user?

I think this may be in RFC documnt or already discussed, but I couldn't find. Sorry if it's too trivial.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Geoffrey Huang <[email-masked]>
Date: Fri, 25 Mar 2005 12:54:27 -0800

This should be an implementation/policy decision.

-g

---

From: "William Dixon" <[email-masked]>
Date: Fri, 25 Mar 2005 23:29:45 -0500

I think I know what Geoff means, but this is actually covered by RFC 2401
page 21, 22:

"A compliant implementation MUST support
           both types of lifetimes, and must support a simultaneous use
           of both.  If time is employed, and if IKE employs X.509
           certificates for SA establishment, the SA lifetime must be
           constrained by the validity intervals of the certificates,
and the NextIssueDate of the CRLs used in the IKE exchange for the SA.
Both initiator and responder are responsible for
           constraining SA lifetime in this fashion.
           [REQUIRED for all implementations]"

-Wm

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Geoffrey Huang
> Sent: Friday, March 25, 2005 3:54 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Ipsec] SA Life time and Certificate expiration date
> 
> > What shoud the IKE do if the user configure SA life time ( 
> say 5 days) is more than the certificate remaining time (say, 
> the certifcate will be expired in 3 days)? Should we pick the 
> minimum of {the SA life time the user configured, the 
> certificate remaining time}, or should we abort IKE and send 
> audit to the user?
> > 
> > I think this may be in RFC documnt or already discussed, 
> but I couldn't find. Sorry if it's too trivial.
> > 
> > 
> > 
> >

---

From: Geoffrey Huang <[email-masked]>
Date: Fri, 25 Mar 2005 21:39:57 -0800

Doh - well, I stand corrected :-).

-g