Subject: Re: [Netconf] Updating NETCONF over TLS document (RFC5539)

From: Kent Watsen <[email-masked]>
Date: Fri, 3 Jun 2011 08:33:09 -0700

If we choose to proceed with this RFC, it would be good to reference RFC 6125 (Service Identity) as guidance for how the NetConf server's certificate should be constructed.  

Regarding client certificates, note the first bullet in section 1.7.2 (Out of Scope):

  o  Client or end-user identities.

      Certificates representing client or end-user identities (e.g., the
      rfc822Name identifier) can be used for mutual authentication
      between a client and server or between two clients, thus enabling
      stronger client-server security or end-to-end security.  However,
      certification authorities, application developers, and service
      operators have less experience with client certificates than with
      server certificates, thus giving us fewer models from which to
      generalize and a less solid basis for defining best practices.

Kent