Re: [Syslog] Need your inputonfinalissueson draft-ietf-syslog-transport-tls

["Rainer Gerhards" <rgerhards at hq.adiscon.com>]

> -----Original Message-----
> From: syslog-bounces at ietf.org [mailto:syslog-bounces at ietf.org] On
> Behalf Of Pasi.Eronen at nokia.com
> Sent: Tuesday, September 02, 2008 8:17 AM
> To: jsalowey at cisco.com; syslog at ietf.org
> Subject: Re: [Syslog] Need your inputonfinalissueson
draft-ietf-syslog-
> transport-tls
> 
> Joseph Salowey wrote:
> 
> > [Joe] Today, there are CA's that issue certificates with wildcards
> > in the hostname.  It would be good if Syslog implementations could
> > be configured to work with these CA's.  It is not required that this
> > support always be enabled.  Would the addition help:
> >
> > "The '*' (ASCII 42) wildcard character is allowed in subjectAltName
> > values of type dNSName (and in Common Name, if used), and then only
> > as the left-most (least significant) DNS label in that value.  This
> > wildcard matches any left-most DNS label in the server name.  That
> > is, the subject *.example.com matches the server names a.example.com
> > and b.example.com, but does not match example.com or
> > a.b.example.com.  Implementations SHOULD provide the ability to
> > enable support for these types of wildcards within the host name in
> > the certificate. "
> 
> I think this needs to be "Implementations MUST support wildcards in
> certificates as specified above, but MAY provide a configuration
> option to disable them."

So we require an application to support certificates to identify the
remote peer, go great length to prevent anonymous peers ... and then we
introduce anon peers by allowing wildcards inside the certificate?
Well... if that's really our intension, I'll no longer object it. I just
wonder why we don't simply allow plain anon peers as was suggested by
others and me several times...

Rainer
> 
> Best regards,
> Pasi
> _______________________________________________
> Syslog mailing list
> Syslog at ietf.org
> https://www.ietf.org/mailman/listinfo/syslog
_______________________________________________
Syslog mailing list
Syslog at ietf.org
https://www.ietf.org/mailman/listinfo/syslog