Domain Certificates in the Session Initiation Protocol (SIP)
RFC 5922
| Document | Type |
RFC - Proposed Standard
(June 2010; No errata)
Updates RFC 3261
|
|
|---|---|---|---|
| Last updated | 2015-10-14 | ||
| Replaces | draft-gurbani-sip-domain-certs | ||
| Stream | IETF | ||
| Formats | plain text pdf html bibtex | ||
| Stream | WG state | (None) | |
| Document shepherd | No shepherd assigned | ||
| IESG | IESG state | RFC 5922 (Proposed Standard) | |
| Consensus Boilerplate | Unknown | ||
| Telechat date | |||
| Responsible AD | Robert Sparks | ||
| Send notices to | (None) | ||
Internet Engineering Task Force (IETF) V. Gurbani
Request for Comments: 5922 Bell Laboratories, Alcatel-Lucent
Updates: 3261 S. Lawrence
Category: Standards Track
ISSN: 2070-1721 A. Jeffrey
Bell Laboratories, Alcatel-Lucent
June 2010
Domain Certificates in the Session Initiation Protocol (SIP)
Abstract
This document describes how to construct and interpret certain
information in a PKIX-compliant (Public Key Infrastructure using
X.509) certificate for use in a Session Initiation Protocol (SIP)
over Transport Layer Security (TLS) connection. More specifically,
this document describes how to encode and extract the identity of a
SIP domain in a certificate and how to use that identity for SIP
domain authentication. As such, this document is relevant both to
implementors of SIP and to issuers of certificates.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc5922.
Gurbani, et al. Standards Track [Page 1]
RFC 5922 Domain Certs June 2010
Copyright Notice
Copyright (c) 2010 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction ....................................................3
2. Terminology .....................................................3
2.1. Key Words ..................................................3
3. Problem Statement ...............................................3
4. SIP Domain to Host Resolution ...................................5
5. The Need for Mutual Interdomain Authentication ..................6
6. Certificate Usage by a SIP Service Provider .....................7
7. Behavior of SIP Entities ........................................8
7.1. Finding SIP Identities in a Certificate ....................8
7.2. Comparing SIP Identities ...................................9
7.3. Client Behavior ...........................................10
7.4. Server Behavior ...........................................11
7.5. Proxy Behavior ............................................12
7.6. Registrar Behavior ........................................12
7.7. Redirect Server Behavior ..................................12
7.8. Virtual SIP Servers and Certificate Content ...............12
8. Security Considerations ........................................13
8.1. Connection Authentication Using Digest ....................13
9. Acknowledgments ................................................14
10. References ....................................................14
10.1. Normative References .....................................14
10.2. Informative References ...................................15
Appendix A. Editorial Guidance (Non-Normative) ...................16
A.1. Additions .................................................16
A.2. Changes ...................................................16
A.2.1. Changes to Section 26.3.1 .............................16
Gurbani, et al. Standards Track [Page 2]
RFC 5922 Domain Certs June 2010
1. Introduction
RFC 5246 [5] Transport Layer Security (TLS) is available in an
increasing number of Session Initiation Protocol (SIP) RFC 3261 [2]
implementations. In order to use the authentication capabilities of
TLS, certificates as defined by the Internet X.509 Public Key
Infrastructure, see RFC 5280 [6], are required.
Existing SIP specifications do not sufficiently specify how to use
Show full document text