Subject: [dane] Specifying the certificate encoding in the spec

From: Pieter Lexis <[email-masked]>
Date: Fri, 03 Feb 2012 13:08:12 +0100

Hi,

In older drafts it explicitly says that the certificate for association
should be DER encoded:

(from draft 6): "..are structured using the RFC 5280 formatting rules
and use the DER encoding."

Draft 10 dropped this sentence in favour of '..apply to PKIX-formatted
certificates.' in section 2.1.1. This, to me, was unclear that it
referred to the DER encoded certificate.

I think this should be clarified, or at least mentioned that
PKIX-formatted certificates MUST be DER encoded for use in TLSA records.

This makes it immediately clear how the certificates from the TLS
session should be treated without reading RFC 5280.

Regards,

Pieter Lexis

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 3 Feb 2012 08:22:31 -0500

> PKIX-formatted certificates MUST be DER encoded for use in TLSA records.

+1

This seems like the correct phrasing to me.

--Richard

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 3 Feb 2012 07:00:17 -0800

> PKIX-formatted certificates MUST be DER encoded for use in TLSA records.

I believe we removed it because it was considered redundant. What other encoding do you believe PKIX-formatted certificates might appear in?

--Paul Hoffman

---

From: "Richard L. Barnes" <[email-masked]>
Date: Fri, 3 Feb 2012 10:41:54 -0500

Well, for example PEM.

rbarnes$ man x509

X509(1)                             OpenSSL                            X509(1)

NAME
       x509 - Certificate display and signing utility

SYNOPSIS
       openssl x509 [-inform DER|PEM|NET] [-outform DER|PEM|NET] [-keyform
       DER|PEM] ...

On Feb 3, 2012, at 10:00 AM, Paul Hoffman wrote:

> _______________________________________________
> dane mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dane

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 3 Feb 2012 07:48:40 -0800

> Well, for example PEM.

You mean "PEM in ASCII". (PEM itself is actually binary, but people have forgotten that...)

Good point, worth adding back to the draft.

--Paul Hoffman

---

From: Pieter Lexis <[email-masked]>
Date: Fri, 03 Feb 2012 17:20:49 +0100

>> Well, for example PEM.

Exactly.

> Good point, worth adding back to the draft.

Good, it'll be easier for implementers :).

Regards,

Pieter Lexis