The IESG has received a request from the Extensible Messaging and Presence Protocol WG (xmpp) to consider the following document: - 'PKIX over Secure HTTP (POSH)' <draft-ietf-xmpp-posh-04.txt> as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2015-07-08. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract Experience has shown that it is extremely difficult to deploy proper PKIX certificates for TLS in multi-tenanted environments. As a result, domains hosted in such environments often deploy applications using certificates that identify the hosting service, not the hosted domain. Such deployments force end users and peer services to accept a certificate with an improper identifier, resulting in obvious security implications. This document defines two methods that make it easier to deploy certificates for proper server identity checking in non-HTTP application protocols. While these methods developed for use in the Extensible Messaging and Presence Protocol (XMPP) as a Domain Name Association (DNA) prooftype, they might also be usable in other non-HTTP application protocols. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-xmpp-posh/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-xmpp-posh/ballot/ No IPR declarations have been submitted directly on this I-D.
