Subject: [Netconf] RC#32: what to do about ClientCertificate?

From: Kent Watsen <[email-masked]>
Date: Wed, 11 Nov 2015 17:30:17 +0000

This is for the untracked issue I mentioned at the mic:

https://github.com/netconf-wg/restconf/issues/32

Here is the text of the issue:

=====START=====
Section 2.5 lists ClientCertificate as one of a set of 3 auth schemes that MUST be implemented.  But draft-thomson-httpbis-cant-01 expired about 10 months ago, with no recent discussion about resurrecting it.

RC32-01:

Work with the httpbis WG to resurrect the expired draft.   This may cause the RFC Editor to hold the draft longer than otherwise needed.

RC32-02:

Remove ClientCertificate from the list.   Effectively stating that the server MUST implement at least Basic or Digest, excluding the possibility that it could avoid password-based authentication.

RC32-03:

Assert that only client-certificate based auth is supported (like NETCONF over TLS).   This would effectively remove the need for WWW-Authenticate altogether.

=====STOP=====

Please send your comments to the list.

Thanks,
Kent