Subject: [netconf] draft-ietf-netconf-trust-anchors-02 certificate expiration

From: Balázs Kovács <[email-masked]>
Date: Fri, 15 Feb 2019 16:24:11 +0000

Hi Kent,

When looking at the model in subject, I was wondering why certificate expiration notifications of pinned certificates are emitted? I would think that the node should not be concerned about sending notifications of certificates of other nodes, and also one wouldn't like to receive a notification N-times for a single pinned certificate that is going to expire.

Could you please comment on this?

Thanks,
Balazs

---

From: Kent Watsen <[email-masked]>
Date: Mon, 18 Feb 2019 17:46:14 +0000

Hi Balazs,

Yes, it is the responsibility of the certificate-issuer to issue an update, but it is also the responsibility of the server-admin to re-pin the updated-certificate.  This alerts the server-admin that a service may stop working and they should update the pinned-certificate before it expires.

To reproduce the equivalent of there being no notifications, the server-admin could chose to ignore expiration-notifications for all pinned-certificated.   That said, it seems better to give the choice to the server-admin than for there to be no choice.

Thoughts?

Kent // contributor

> On Feb 15, 2019, at 11:24 AM, Balázs Kovács <[email-masked]> wrote:
> 
> Hi Kent,
>  
> When looking at the model in subject, I was wondering why certificate expiration notifications of pinned certificates are emitted? I would think that the node should not be concerned about sending notifications of certificates of other nodes, and also one wouldn’t like to receive a notification N-times for a single pinned certificate that is going to expire.
>  
> _______________________________________________
> netconf mailing list
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/netconf <https://www.ietf.org/mailman/listinfo/netconf>

---

From: Balázs Kovács <[email-masked]>
Date: Thu, 21 Feb 2019 09:45:51 +0000

Hi Kent,

I think the approach you describe is correct. I was assuming that both the owner of the pinned certificate and the device configured with the pinned certificate are in the same administrative domain. This obviously might not be true in some environments.

Thank you,
Balazs

From: Kent Watsen <[email-masked]>
Sent: Monday, February 18, 2019 6:46 PM
To: Balázs Kovács <[email-masked]>
Cc: [email-masked]
Subject: Re: [netconf] draft-ietf-netconf-trust-anchors-02 certificate expiration

Hi Balazs,

Thoughts?

Kent // contributor

On Feb 15, 2019, at 11:24 AM, Balázs Kovács <[email-masked]<mailto:[email-masked]>> wrote:

Hi Kent,

Thanks,
Balazs
_______________________________________________
netconf mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/netconf