Subject: Re: [dane] #10: Considerations related to the comprimise of an intermediate CA

From: "dane issue tracker" <[email-masked]>
Date: Thu, 05 Jan 2012 21:32:43 -0000

#10: Considerations related to the comprimise of an intermediate CA

Changes (by warren@…):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 As discussed at the IETF82 meeting
 (http://www.ietf.org/proceedings/82/minutes/dane.txt ) and then taken to
 the list (http://www.ietf.org/mail-archive/web/dane/current/msg03975.html
 ) text was added to the document to address this.

 Text added to satisfy  #10:
            If a server's certificate is revoked, or if an intermediate CA
 in a
            chain between the end entity and a trust anchor has its
 certificate
            revoked, a TLSA record with a certificate type of 2 that
 matches the
            revoked certificate would in essence override the revocation
 because
            the client would treat that revoked certificate as a trust
 anchor and
            thus not check its revocation status.  Because of this, domain
            administrators need to be responsible for being sure that the
 key or
            certificate used in TLSA records with a certificate type of 2
 are in
            fact able to be used as reliable trust anchors.

-- 
------------------------+---------------------
 Reporter:  mlepinsk@…  |       Owner:
     Type:  defect      |      Status:  closed
 Priority:  minor       |   Milestone:
Component:  protocol    |     Version:
 Severity:  -           |  Resolution:  fixed
 Keywords:              |
------------------------+---------------------

Ticket URL: <http://trac.tools.ietf.org/wg/dane/trac/ticket/10#comment:1>
dane <http://tools.ietf.org/dane/>