Subject: [AAA-WG]: [issue] A Diameter node must use its own TLS certificate

From: Don Zick <[email-masked]>
Date: Tue, 08 Jan 2002 09:50:08 -0500

Issue Number: To be assigned by Pat Calhoun
Description of issue: A Diameter node must use its own TLS certificate
Submitter name: Don Zick
Date first submitted: 1/2/2
Document: base
Comment type: T
Priority: 1
Section: 2.2 Securing Diameter Messages
Rationale/Explanation of issues:

The Diameter base draft does not address how to ensure that a Diameter
node is using its own TLS certificate.   It is important to ensure that
a Diameter node is using its own TLS certificate so that if a single
Diameter node becomes compromised, it won't break security for all of
the other Diameter nodes.

It is a common practice with TLS to put a node's identity into the
certificate's subjectAltName dNSName field. The Diameter CMS Security
Application takes this approach.  Below is a section from the Diameter
CMS Security Application draft 3:

>3.2  Certificate Requirements
>
>   Certificates used for the purposes of Diameter MUST conform to the
>   PKIX profile [4], and MUST also include a Diameter node's FQDN,
which
>   is typically added in the Origin-Host AVP [1], as one of the values
>   of the subjectAltName extension of the Certificate.  The FQDN is to
>   be encoded as a dNSName within the subjectAltName.
>
>   For Diameter nodes (capable of acting as recipients for
>   confidentiality), the FQDN MUST be of the form
>   "Diameter-<xxx>.<realm>". Other Diameter nodes MAY use this naming
>   scheme. Note that this naming constraint is for PKI purposes only,
>   and in no way restricts a Diameter's host name.

Requested change:

Make Diameter TLS have the same dNSName field requirements as the
Diameter CMS Security Application.