Skip to main content

Early Review of draft-ietf-uta-rfc6125bis-08

Request Review of draft-ietf-uta-rfc6125bis
Requested revision No specific revision (document currently at 15)
Type Early Review
Team Ops Directorate (opsdir)
Deadline 2023-01-02
Requested 2022-12-12
Requested by Valery Smyslov
Authors Peter Saint-Andre , Rich Salz
I-D last updated 2022-12-16
Completed reviews Dnsdir Telechat review of -15 by Petr Špaček
Dnsdir Last Call review of -12 by Petr Špaček (diff)
Tsvart Last Call review of -12 by Dr. Joseph D. Touch (diff)
Genart Last Call review of -12 by Ines Robles (diff)
Dnsdir Last Call review of -12 by Petr Špaček (diff)
Dnsdir Last Call review of -14 by Petr Špaček (diff)
Secdir Early review of -08 by Derrell Piper (diff)
Opsdir Early review of -08 by Qin Wu (diff)
Assignment Reviewer Qin Wu
State Completed
Request Early review on draft-ietf-uta-rfc6125bis by Ops Directorate Assigned
Posted at
Reviewed revision 08 (document currently at 15)
Result Has nits
Completed 2022-12-16
I have reviewed this document as part of the Operational directorate's ongoing
effort to review all IETF documents being processed by the IESG. These comments
were written with the intent of improving the operational aspects of the IETF
drafts. Comments that are not addressed in last call may be included in AD
reviews during the IESG review.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document specifies procedures for representing and verifying the
application services identity in TLS interaction with PKI X.509 certificates.

I believe this document is well written and ready for publication.

Major issue:

Minor issues:
1.Section 1.2 Applicability
s/ cetrificate/certificate

2. Delegated domain definition
“ For example, a server at could be a delegated domain for
connecting to an IMAP server hosting an email address of ” I
can not parse this sentence, is the server a delegated domain? Which domain is
the source domain? Which domain is delegated domain ? please make this clear in
the example. 3.Section 2 Identifying Application Service What is meaning
difference between _direct_ and direct or _indirect_ and indirect? In section
2, sometimes _direct_/_indirect_ is used, sometimes direct/indirect is used.

4.Section 2 said:
“   We can categorize the three identifier types as follows:

   *  A DNS-ID is direct and unrestricted.

   *  An IP-ID is direct and unrestricted.

   *  An SRV-ID is typically indirect but can be direct, and is

   *  A URI-ID is direct and restricted.
Three identifier types or four identifier types? My impression is the latter.

5.Section 2

6.Section 3 said:
“In this case, applications need
   to be aware that the textual representation of an IPv4 address can
   appear to be a valid DNS name, though it is not.  ”
it in the text ‘though it is not’ is referred to digit representation of an
IPv4 address? Or not?

7.Section 7.1
I am surprised there is no protection measures to mitigate risk of vouching for
rogue or buggy hosts in this document?