Internet X.509 Public Key Infrastructure -- HTTP Transfer for the Certificate Management Protocol (CMP)
draft-ietf-lamps-rfc6712bis-10

Received changes through RFC Editor sync (changed state to RFC, created became rfc relationship between draft-ietf-lamps-rfc6712bis and RFC 9811, changed IESG state to RFC Published)

[Ballot comment]
Many thanks to Lucas Pardue for his HTTPDIR review: https://mailarchive.ietf.org/arch/msg/spasm/YZDm6rcWT_kFNw7gbuqfIgvAtzk/, and thank you to the authors for working with Lucas on addressing his comments.

[Ballot comment]
Thanks for working on this specification. Thanks to Lucas for HTTPDir review which has improved the document.

Now that the rfc4210-bis says the transport protocols MUST be reliable, I think we need to update the text in section 3. Currently it says -

  For direct interaction between two entities, where a reliable transport protocol like TCP [RFC9293] is available, HTTP [RFC9110] SHOULD be utilized for conveying CMP messages.

If rfc4210-bis is followed the there should not be any unreliale transport to carry CMP message. The current text is written as if the could be unreable transport to carry CMP message.

[Ballot comment]
Thanks to Claudio Allocchio for the ARTART review, and to the authors for addressing the feedback.

I still wonder if section 3.4 should more strongly encourage the use of HTTPS through examples, why not:

```
https://www.example.com/.well-known/cmp

https://www.example.com/.well-known/cmp/

https://www.example.com/.well-known/cmp/p/

https://www.example.com/.well-known/cmp/p//

Note that http can also be used instead of https, see item 5 in the Security Considerations (Section 5).

```

[Ballot comment]
The IANA review of this document seems to not have concluded yet.

No reference entries found for these items, which were mentioned in the text:
[[RFC2818], [draft-ietf-anima-brski-ae],
[draft-ietf-lamps-rfc4210bis-12], and [RFC2616].

-------------------------------------------------------------------------------
NIT
-------------------------------------------------------------------------------

All comments below are about very minor potential issues that you may choose to
address in some way - or ignore - as you see fit. Some were flagged by
automated tools (via https://github.com/larseggert/ietf-reviewtool), so there
will likely be some false positives. There is no need to let me know what you
did with these suggestions.

Reference [RFC5246] to RFC5246, which was obsoleted by RFC8446 (this may be on
purpose).

Reference [RFC2510] to RFC2510, which was obsoleted by RFC4210 (this may be on
purpose).

Section 1, paragraph 6
>  can benefit from utilizing a reliable transport as CMP requires connection a
>                            ^^^^^^^^^^^^^^^^^^^^
Uncountable nouns are usually not used with an indefinite article. Use simply
"reliable transport".

Section 1, paragraph 7
> ng from the transfer protocol. All theses features are covered by HTTP. Addi
>                                    ^^^^^^
Did you mean "these"?

Section 1.1, paragraph 1
> in Section 1.1 of this document. Additionally it adds the following changes:
>                                  ^^^^^^^^^^^^
A comma may be missing after the conjunctive/linking adverb "Additionally".

IESG/Authors/WG Chairs:

IANA has completed its review of draft-ietf-lamps-rfc6712bis-07. If any part of this review is inaccurate, please let us know.

IANA understands that, upon approval of this document, there are four actions which we must complete.

First, in the application namespace in the Media Types registry located at:

https://www.iana.org/assignments/media-types/

the reference for the registration of:

application/pkixcmp

will be changed from RFC2510 to [ RFC-to-be ].

Second, in the CoAP Content-Formats registry in the Constrained RESTful Environments (CoRE) Parameters registry group located at:

https://www.iana.org/assignments/core-parameters/

the reference for:

Content Type: application/pkixcmp
ID: 259

will be changed from [RFC9482][RFC4210] to [ RFC-to-be ].

Third, in the Well-Known URIs registry located at:

https://www.iana.org/assignments/well-known-uris/

the reference for the registration of URI Suffix cmp will be changed from: [RFC9480][RFC9482] to [ RFC-to-be ].

Fourth, in the CMP Well-Known URI Path Segments registry in the Certificate Management Protocol (CMP) registry group located at:

https://www.iana.org/assignments/cmp/

the reference for the registration of Path Segment: p will be changed from [RFC9480][RFC9482] to [ RFC-to-be ].

We understand that these are the only actions required to be completed upon approval of this document.

NOTE: The actions requested in this document will not be completed until the document has been approved for publication as an RFC. This message is meant only to confirm the list of actions that will be performed.

For definitions of IANA review states, please see:

https://datatracker.ietf.org/help/state/draft/iana-review

Thank you,

David Dong
IANA Services Sr. Specialist

The following Last Call announcement was sent out (ends 2024-10-23):

From: The IESG
To: IETF-Announce
CC: debcooley1@gmail.com, draft-ietf-lamps-rfc6712bis@ietf.org, housley@vigilsec.com, lamps-chairs@ietf.org, spasm@ietf.org
Reply-To: last-call@ietf.org
Sender:
Subject: Last Call:  (Internet X.509 Public Key Infrastructure -- HTTP Transfer for the Certificate Management Protocol (CMP)) to Proposed Standard


The IESG has received a request from the Limited Additional Mechanisms for
PKIX and SMIME WG (lamps) to consider the following document: - 'Internet
X.509 Public Key Infrastructure -- HTTP Transfer for the
  Certificate Management Protocol (CMP)'
  as Proposed Standard

The IESG plans to make a decision in the next few weeks, and solicits final
comments on this action. Please send substantive comments to the
last-call@ietf.org mailing lists by 2024-10-23. Exceptionally, comments may
be sent to iesg@ietf.org instead. In either case, please retain the beginning
of the Subject line to allow automated sorting.

Abstract


  This document describes how to layer the Certificate Management
  Protocol (CMP) over HTTP.

  It includes the updates on RFC 6712 specified in CMP Updates RFC 9480
  Section 3 and obsoleted both documents.  These updates introduce CMP
  URIs using a Well-known prefix.




The file can be obtained via
https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc6712bis/



No IPR declarations have been submitted directly on this I-D.

Shepherd Write-up for draft-ietf-lamps-rfc6712bis-05


(1) What type of RFC is being requested (BCP, Proposed Standard, Internet
Standard, Informational, Experimental, or Historic)?  Why is this the
proper type of RFC?  Is this type of RFC indicated in the title page
header?

  Proposed Standard.  Yes, the header calls for Standards Track.

  When RFC 9480 was approved by the IESG, the LAMPS WG was asked to make
  a bis document instead of a complicated update document.  Here it is...


(2) The IESG approval announcement includes a Document Announcement
Write-Up.  Please provide such a Document Announcement Write-Up.  Recent
examples can be found in the "Action" announcements for approved
documents.  The approval announcement contains the following sections:

  Technical Summary:

    This document describes how to layer the Certificate Management
    Protocol (CMP) over HTTP.  This document will obsolete RFC 6712 and
    RFC 9480.

  Working Group Summary:

    There is consensus for this document in the LAMPS WG.

  Document Quality:

    Vendors with CMP implementations have indicated that they intend to
    support the updated specification, and at least one open source effort
    is underway.
   
  Personnel:

    Russ Housley is the document shepherd.
    Deb Cooley is the responsible area director.


(3) Briefly describe the review of this document that was performed by
the Document Shepherd.  If this version of the document is not ready for
publication, please explain why the document is being forwarded to the
IESG.

  The LAMPS WG supported the updates in RFC 9480. The document shepherd
  did a thorough review of the document during WG Last Call.  All issues
  were resolved.


(4) Does the document shepherd have any concerns about the depth or
breadth of the reviews that have been performed?

  No concerns.


(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization?  If so, describe the review that took
place.

  Several people that were involved in the PKIX WG were part of the
  review that took place during LAMPS WG Last Call.


(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the IESG
should be aware of?  For example, perhaps he or she is uncomfortable with
certain parts of the document, or has concerns whether there really is a
need for it.  In any event, if the WG has discussed those issues and has
indicated that it still wishes to advance the document, detail those
concerns here.

  No concerns.


(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP 78
and BCP 79 have already been filed.  If not, explain why?

  The authors have explicitly stated that they are unaware of any
  additional IP that was introduced in the updates to RFC 6712.

  The authors have explicitly stated that they do not hold any IPR
  related to the updates to RFC 6712.

  Note that RFC 4210 was written prior to the publication of RFC 5378,
  and RFC 6712 updates RFC 4210.  Further, RFC 6712 contains the pre-
  5378 boilerplate text.  However, each of the authors of RFC 4210 have
  been contacted and each of them has explicitly released rights to the
  IETF Trust.  A document for signature has been sent to the authors by
  the IETF Trust, and we expect that it will be signed before IETF
  Last Call completes.  Therefore, the pre5378Trust200902 IPR
  Boilerplate is not used.


(8) Has an IPR disclosure been filed that references this document?  If
so, summarize any WG discussion and conclusion regarding the IPR
disclosures.

  No IPR disclosures were issued against this document.


(9) How solid is the WG consensus behind this document?  Does it
represent the strong concurrence of a few individuals, with others being
silent, or does the WG as a whole understand and agree with it?

  There is consensus for this document in the LAMPS WG.


(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent?  If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director.  (It should be in a
separate email because this questionnaire is publicly available.)

  No one has threatened an appeal.


(11) Identify any ID nits the Document Shepherd has found in this
document.  (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist).  Boilerplate checks are not enough; this check needs to be
thorough.

  This document will obsolete RFC 6712 and RFC 9480.


(12) Describe how the document meets any required formal review criteria,
such as the MIB Doctor, media type, and URI type reviews.

  No special reviews are needed.


(13) Have all references within this document been identified as either
normative or informative?

  Yes.


(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state?  If such normative
references exist, what is the plan for their completion?

  [I-D.ietf-lamps-rfc4210bis] is a normative reference, and these two
  documents are being sent to the IESG at the same time.


(15) Are there downward normative references references (see RFC 3967)?
If so, list these downward references to support the Area Director in the
Last Call procedure.

  There are no downward references.


(16) Will publication of this document change the status of any existing
RFCs?  Are those RFCs listed on the title page header, listed in the
abstract, and discussed in the introduction?  If the RFCs are not listed
in the Abstract and Introduction, explain why, and point to the part of
the document where the relationship of this document to the other RFCs is
discussed.  If this information is not in the document, explain why the
WG considers it unnecessary.

  This document will obsolete RFC 6712 and RFC 9480, which is
  clearly stated on the title page and the Abstract.


(17) Describe the Document Shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document.  Confirm that all protocol extensions that the document makes
are associated with the appropriate reservations in IANA registries.
Confirm that any referenced IANA registries have been clearly identified.
Confirm that newly created IANA registries include a detailed
specification of the initial contents for the registry, that allocations
procedures for future registrations are defined, and a reasonable name
for the new registry has been suggested (see RFC 5226).

  Updates to some IANA registries are needed so that existing registry
  entries point to this document instead of RFC 2510 or RFC 4210.


(18) List any new IANA registries that require Expert Review for future
allocations.  Provide any public guidance that the IESG would find useful
in selecting the IANA Experts for these new registries.

  No new IANA registries are needed.


(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.

  None.

Shepherd Write-up for draft-ietf-lamps-rfc6712bis-05


(1) What type of RFC is being requested (BCP, Proposed Standard, Internet
Standard, Informational, Experimental, or Historic)?  Why is this the
proper type of RFC?  Is this type of RFC indicated in the title page
header?

  Proposed Standard.  Yes, the header calls for Standards Track.

  When RFC 9480 was approved by the IESG, the LAMPS WG was asked to make
  a bis document instead of a complicated update document.  Here it is...


(2) The IESG approval announcement includes a Document Announcement
Write-Up.  Please provide such a Document Announcement Write-Up.  Recent
examples can be found in the "Action" announcements for approved
documents.  The approval announcement contains the following sections:

  Technical Summary:

    This document describes how to layer the Certificate Management
    Protocol (CMP) over HTTP.  This document will obsolete RFC 6712 and
    RFC 9480.

  Working Group Summary:

    There is consensus for this document in the LAMPS WG.

  Document Quality:

    Vendors with CMP implementations have indicated that they intend to
    support the updated specification, and at least one open source effort
    is underway.
   
  Personnel:

    Russ Housley is the document shepherd.
    Deb Cooley is the responsible area director.


(3) Briefly describe the review of this document that was performed by
the Document Shepherd.  If this version of the document is not ready for
publication, please explain why the document is being forwarded to the
IESG.

  The LAMPS WG supported the updates in RFC 9480. The document shepherd
  did a thorough review of the document during WG Last Call.  All issues
  were resolved.


(4) Does the document shepherd have any concerns about the depth or
breadth of the reviews that have been performed?

  No concerns.


(5) Do portions of the document need review from a particular or from
broader perspective, e.g., security, operational complexity, AAA, DNS,
DHCP, XML, or internationalization?  If so, describe the review that took
place.

  Several people that were involved in the PKIX WG were part of the
  review that took place during LAMPS WG Last Call.


(6) Describe any specific concerns or issues that the Document Shepherd
has with this document that the Responsible Area Director and/or the IESG
should be aware of?  For example, perhaps he or she is uncomfortable with
certain parts of the document, or has concerns whether there really is a
need for it.  In any event, if the WG has discussed those issues and has
indicated that it still wishes to advance the document, detail those
concerns here.

  No concerns.


(7) Has each author confirmed that any and all appropriate IPR
disclosures required for full conformance with the provisions of BCP 78
and BCP 79 have already been filed.  If not, explain why?

  The authors have explicitly stated that they are unaware of any
  additional IP that was introduced in the updates to RFC 6712.

  The authors have explicitly stated that they do not hold any IPR
  related to the updates to RFC 6712.

  Note that RFC 4210 was written prior to the publication of RFC 5378,
  and RFC 6712 updates RFC 4210.  Further, RFC 6712 contains the pre-
  5378 boilerplate text.  However, each of the authors of RFC 4210 have
  been contacted and each of them has explicitly released rights to the
  IETF Trust.  A document for signature has been sent to the authors by
  the IETF Trust, and we expect that it will be signed before IETF
  Last Call completes.  Therefore, the pre5378Trust200902 IPR
  Boilerplate is not used.


(8) Has an IPR disclosure been filed that references this document?  If
so, summarize any WG discussion and conclusion regarding the IPR
disclosures.

  No IPR disclosures were issued against this document.


(9) How solid is the WG consensus behind this document?  Does it
represent the strong concurrence of a few individuals, with others being
silent, or does the WG as a whole understand and agree with it?

  There is consensus for this document in the LAMPS WG.


(10) Has anyone threatened an appeal or otherwise indicated extreme
discontent?  If so, please summarise the areas of conflict in separate
email messages to the Responsible Area Director.  (It should be in a
separate email because this questionnaire is publicly available.)

  No one has threatened an appeal.


(11) Identify any ID nits the Document Shepherd has found in this
document.  (See http://www.ietf.org/tools/idnits/ and the Internet-Drafts
Checklist).  Boilerplate checks are not enough; this check needs to be
thorough.

  This document will obsolete RFC 6712 and RFC 9480.


(12) Describe how the document meets any required formal review criteria,
such as the MIB Doctor, media type, and URI type reviews.

  No special reviews are needed.


(13) Have all references within this document been identified as either
normative or informative?

  Yes.


(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state?  If such normative
references exist, what is the plan for their completion?

  [I-D.ietf-lamps-rfc4210bis] is a normative reference, and these two
  documents are being sent to the IESG at the same time.


(15) Are there downward normative references references (see RFC 3967)?
If so, list these downward references to support the Area Director in the
Last Call procedure.

  There are no downward references.


(16) Will publication of this document change the status of any existing
RFCs?  Are those RFCs listed on the title page header, listed in the
abstract, and discussed in the introduction?  If the RFCs are not listed
in the Abstract and Introduction, explain why, and point to the part of
the document where the relationship of this document to the other RFCs is
discussed.  If this information is not in the document, explain why the
WG considers it unnecessary.

  This document will obsolete RFC 6712 and RFC 9480, which is
  clearly stated on the title page and the Abstract.


(17) Describe the Document Shepherd's review of the IANA considerations
section, especially with regard to its consistency with the body of the
document.  Confirm that all protocol extensions that the document makes
are associated with the appropriate reservations in IANA registries.
Confirm that any referenced IANA registries have been clearly identified.
Confirm that newly created IANA registries include a detailed
specification of the initial contents for the registry, that allocations
procedures for future registrations are defined, and a reasonable name
for the new registry has been suggested (see RFC 5226).

  Updates to some IANA registries are needed so that existing registry
  entries point to this document instead of RFC 2510 or RFC 4210.


(18) List any new IANA registries that require Expert Review for future
allocations.  Provide any public guidance that the IESG would find useful
in selecting the IANA Experts for these new registries.

  No new IANA registries are needed.


(19) Describe reviews and automated checks performed by the Document
Shepherd to validate sections of the document written in a formal
language, such as XML code, BNF rules, MIB definitions, etc.

  None.