Subject: [quicwg/base-drafts] Mandating use of CN-ID is not modern practice (#4769)

From: Martin Thomson <[email-masked]>
Date: Tue, 19 Jan 2021 18:50:55 -0800

@kaduk's review of -http identified use of the subject:commonName field in validating server identity.

We should not elevate CN-ID to MUST.  In doing so, we invalidate what CABF has done: 7.1.4.2.2 clause a of the Baseline Requirements marks subject:commonName as deprecated and discouraged.

My understanding (which I can confirm) is that browsers do not use CN-ID (concretely, the CN field of the certificate subject) and so we might want to just mention the dNSName type of subjectAltName here.  We can *mention* that some clients might use subject:commonName, but that this is a deprecated practice.  This accounts for some of the older certificate validation code that still exists in some places.  Some of that does rely on the common name.

I realize that this likely breaks new ground for the RFC series, and it likely needs more discussion, but maybe we can keep up with the times with this document.

(I apologize for not having caught this earlier; I think that this is copied from elsewhere and that too needs a refresh.)

_Originally posted by @martinthomson in https://github.com/quicwg/base-drafts/pull/4767#discussion_r560635858_

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769

---

From: kaduk <[email-masked]>
Date: Tue, 19 Jan 2021 20:07:24 -0800

There is some probably relevant discussion for http-semantics at https://github.com/httpwg/http-core/issues/404 (though as was noted recently the change that closed that issue had some issues of its own)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769#issuecomment-763315644

---

From: Lars Eggert <[email-masked]>
Date: Tue, 26 Jan 2021 03:34:45 -0800

Marking as design, since #4808 is.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769#issuecomment-767484934

---

From: Mike Bishop <[email-masked]>
Date: Tue, 26 Jan 2021 16:06:05 -0800

Closed #4769 via #4808.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769#event-4253295744

---

From: Mike Bishop <[email-masked]>
Date: Tue, 26 Jan 2021 16:07:12 -0800

Reopened #4769.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769#event-4253299081

---

From: Mike Bishop <[email-masked]>
Date: Tue, 26 Jan 2021 16:07:12 -0800

Reopening for consensus call.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/4769#issuecomment-767912714