Subject: [Dime] Issue #39: Need for additional verification of received certificates when using TLS

From: "Tolga Asveren" <[email-masked]>
Date: Thu, 22 Feb 2007 17:38:48 -0500

I think we all agree that we need some checks on certificates in addition to
what TLS already does. TLS verifies that the certificate is valid but it
doesn't perform any check about for what purpose the certificate is issued.
IMO, the proposal of using  Subject Alternative Name extension makes sense
(dNSName or uniformResourceIdentifier). We can store DiameterURI, Diameter
Identity or domainname.

I believe performing a check for the manual configuration case is relatively
straightforward. The identity of the entity on the other side of the
connection is already known and we check this identity against what is
present in the corresponding field in the certificate.

For dynamic peer discovery case, RFC3588 already provides some guidelines in
5.2 regarding certificate checks (both domainname in the query and
domainname in the replacement must be valid). I am not sure though, how one
would handle the case, where certain service (or routing of messages for
certain service) is delegated to another organization. For example, if I
want to outsource DCCA to OrganizationA but want to handle NASREQ myself,
how could I indicate in the certificate prepared for OrganizationA, that it
is valid for my domain but only for DCCA? Does it make sense to include
application identifier in the certificate to deal with this type of
scenario?

   Thanks,
   Tolga

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime