datatracker.ietf.org
Sign in
Version 5.3.0, 2014-04-12
Report a bug

Internet X.509 Public Key Infrastructure Operational Protocols: FTP and HTTP
RFC 2585

Document type: RFC - Proposed Standard (May 1999; Errata)
Document stream: IETF
Last updated: 2013-03-02
Other versions: plain text, pdf, html

IETF State: (None)
Consensus: Unknown
Document shepherd: No shepherd assigned

IESG State: RFC 2585 (Proposed Standard)
Responsible AD: (None)
Send notices to: No addresses provided

Network Working Group                                        R. Housley
Request for Comments: 2585                                       SPYRUS
Category: Standards Track                                    P. Hoffman
                                                                    IMC
                                                               May 1999

                Internet X.509 Public Key Infrastructure
                  Operational Protocols: FTP and HTTP

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1999).  All Rights Reserved.

Abstract

   The protocol conventions described in this document satisfy some of
   the operational requirements of the Internet Public Key
   Infrastructure (PKI).  This document specifies the conventions for
   using the File Transfer Protocol (FTP) and the Hypertext Transfer
   Protocol (HTTP) to obtain certificates and certificate revocation
   lists (CRLs) from PKI repositories.  Additional mechanisms addressing
   PKIX operational requirements are specified in separate documents.

1  Introduction

   This specification is part of a multi-part standard for the Internet
   Public Key Infrastructure (PKI) using X.509 certificates and
   certificate revocation lists (CRLs).  This document specifies the
   conventions for using the File Transfer Protocol (FTP) and the
   Hypertext Transfer Protocol (HTTP) to obtain certificates and CRLs
   from PKI repositories.  Additional mechanisms addressing PKI
   repository access are specified in separate documents.

Housley & Hoffman           Standards Track                     [Page 1]
RFC 2585       PKIX Operational Protocols:  FTP and HTTP        May 1999

1.1. Model

   The following is a simplified view of the architectural model assumed
   by the Internet PKI specifications.

      +---+
      | C |                       +------------+
      | e | <-------------------->| End entity |
      | r |       Operational     +------------+
      | t |       transactions          ^
      |   |      and management         |  Management
      | / |       transactions          |  transactions
      |   |                             |                PKI users
      | C |                             v
      | R |       -------------------+--+-----------+-----------------
      | L |                          ^              ^
      |   |                          |              |   PKI management
      |   |                          v              |       entities
      | R |                       +------+          |
      | e | <---------------------| RA   | <---+    |
      | p |  Publish certificate  +------+     |    |
      | o |                                    |    |
      | s |                                    |    |
      | I |                                    v    v
      | t |                                +------------+
      | o | <------------------------------|     CA     |
      | r |   Publish certificate          +------------+
      | y |   Publish CRL                         ^
      |   |                                       |
      +---+                        Management     |
                                   transactions   |
                                                  v
                                              +------+
                                              |  CA  |
                                              +------+

   The components in this model are:

   End Entity:  user of PKI certificates and/or end user system that is
                the subject of a certificate;

   CA:          certification authority;

   RA:          registration authority, i.e., an optional system to
                which a CA delegates certain management functions;

Housley & Hoffman           Standards Track                     [Page 2]
RFC 2585       PKIX Operational Protocols:  FTP and HTTP        May 1999

   Repository:  a system or collection of distributed systems that store
                certificates and CRLs and serves as a means of
                distributing these certificates and CRLs to end
                entities.

1.2.  Certificate and CRL Repository

   Some CAs mandate the use of on-line validation services, while others
   distribute CRLs to allow certificate users to perform certificate
   validation themselves.  In general, CAs make CRLs available to

[include full document text]