Subject: [Netconf] keystore and the client/server drafts

From: Kent Watsen <[email-masked]>
Date: Wed, 14 Jun 2017 00:04:08 +0000

Dear WG,

These latest updates reflect all comments received and close all of 
the open issues.  At this point, there are no more issues to resolve.
I believe that these drafts are now ready for Last Call.

  https://tools.ietf.org/html/draft-ietf-netconf-keystore-02
  https://tools.ietf.org/html/draft-ietf-netconf-ssh-client-server-03
  https://tools.ietf.org/html/draft-ietf-netconf-tls-client-server-03
  https://tools.ietf.org/html/draft-ietf-netconf-netconf-client-server-03
  https://tools.ietf.org/html/draft-ietf-netconf-restconf-client-server-03

Thanks,
Kent

---

From: Mahesh Jethanandani <[email-masked]>
Date: Wed, 14 Jun 2017 10:43:06 -0700

With these updates, the chairs plan on starting a Last Call on these documents in a weeks time. If anyone has concerns about the status of these documents, this would be a good time to speak up.

Cheers.

> On Jun 13, 2017, at 5:04 PM, Kent Watsen <[email-masked]> wrote:
> 
> 
> Dear WG,
> 
> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf

Mahesh & Mehmet.

---

From: Balázs Kovács <[email-masked]>
Date: Tue, 20 Jun 2017 07:42:11 +0000

Hi,

1) Kent, you added some text to the description of 'trusted-ca-certs' of tls/ssh-client-grouping, but I think you missed the symmetrical text from the tls/ssh-server-grouping. I believe this sentence should be added to tls/ssh servers, to 'trusted-ca-certs':

"A client certificate is authenticated if it has a valid chain of trust to a configured trusted CA certificate."

2) We talked about adding must statements for 'trusted-*' nodes, and for the tls/ssh server cases we agreed that some TLS/SSH servers might be ok to not do client certificate authentication, but Netconf and Restconf servers do require client certificate. I don't see this expressed with a must statement in the new versions of the drafts:

              uses ts:tls-server-grouping {
                augment "client-auth" {
                  description
                    "Augments in the cert-to-name structure.";
                  uses cert-maps-grouping;
                }
              }

I'd expect a 'must trusted-ca-certs or trusted-client-certs' line.

Br,
Balázs

-----Original Message-----
From: Netconf [mailto:[email-masked]] On Behalf Of Kent Watsen
Sent: Wednesday, June 14, 2017 2:04 AM
To: [email-masked]
Subject: [Netconf] keystore and the client/server drafts

Dear WG,

These latest updates reflect all comments received and close all of the open issues.  At this point, there are no more issues to resolve.
I believe that these drafts are now ready for Last Call.

Thanks,
Kent

---

From: Kent Watsen <[email-masked]>
Date: Tue, 20 Jun 2017 19:28:12 +0000

Hi Balazs,

1) Fixed in my local copy.

2) Fixed to my local copy.  I had added it to the tls/ssh-client-groupings, just missed it in the tls/ssh-server-groupings...

You can see these changes here:

  https://github.com/netconf-wg/ssh-client-server/commit/34d673a812b9f2015af072e7fedfd8a6afb0a3cf
  https://github.com/netconf-wg/tls-client-server/commit/e157926f6de69dce59d15204e7845a98a2bebad9
  https://github.com/netconf-wg/netconf-client-server/commit/9542ce49632a6be6be083ea7475d13007eddd817
  https://github.com/netconf-wg/restconf-client-server/commit/1e7a203670bc03b719151e460737af2e0491ba23

I'll defer posting a new draft for now.

Kent

-----ORIGINAL MESSAGE-----

Hi,

Br,
Balázs

-----Original Message-----
From: Netconf [mailto:[email-masked]] On Behalf Of Kent Watsen
Sent: Wednesday, June 14, 2017 2:04 AM
To: [email-masked]
Subject: [Netconf] keystore and the client/server drafts

Dear WG,

Thanks,
Kent