On Sat, Sep 24, 2016 at 09:31:51PM +1000, Martin Thomson wrote: > On 24 September 2016 at 19:17, Ilari Liusvaara <ilariliusva...@welho.com> > wrote: > > It occured to me that certain extensions might be considered to be per- > > chain. Like e.g. type of the certificate. Where do extensions like that > > go? Always to the extension block of the first certificate (except that > > might cause somewhat of a cyclic dependency in parsing)? > > The type of which certificate? The end-entity? Seems like that > belongs with the end-entity cert then.
I mean equivalent of the client_certificate_type/server_certificate_type extensions. And the way those extensions are defined, those scope the entiere chain. E.g. There was some discussion about "subcerts"[1]. One way to add those would be as a new certificate type. ... Or are new certificate types like new CLASSes in DNS: Heavy objects dropped by bad idea fairy? :-> But in the future, there might very well be new extensions that are scoped to certificate chain and not and individual certificate. And those can't be put into EncryptedExtensions if server can send multiple certificates (like it can in post-handshake auth extension) or if client needs to send one. [1] The usecases can't be practically accomplished today: The mode of operation is just plain alien to X.509. -Ilari _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
