Re: UTA: Server certificate management (Re: Last Call: <draft-ietf-uta-email-tls-certs-05.txt>)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



See: https://tools.ietf.org/html/draft-daboo-aggregated-service-discovery-03
for an attempt that was made a couple of years ago.  We had a BoF that didn't go particularly well, but if there was interest, I'm pretty sure we could do another one and overcome the objections.

For this particular situation, I think that's overkill. We already have RFC 6186 which defines an easy to use way to publish the location of SUBMIT, POP, and IMAP servers, at least if you already have DNSSEC set up. I can confirm that it's easy, it took me about five minutes to add the relevant records to my DNS zones. The SRV records have the domain names of the servers, you check them against the DNS-ID in the servers' certificates, and you're done. You still have to provide your password, but that goes with the territory since the client systems aren't otherwise known to the servers.

The arguments seem to be based on the observation that DNSSEC uptake is slow so maybe we should do something else. Maybe, but it's not my impression that's a winning argument in the IETF.

Regards,
John Levine, johnl@xxxxxxxxx, Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.




[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]