Re: DPD & DPV Basics

[Stephen Kent <kent@xxxxxxx>]

Steve,

I'll weigh in on the IPsec scenario too.

I would expect the (IKE) client to send in the target cert and either 
explicit validation parameters, or a reference to a stored set. 
Checking the key usage could be done at the server or in the client. 
But I do expect the client to do the ID matching against the returned 
cert or cert contents.  I would not want the the server to do this 
because it is application specific and we don't want to require 
servers to know about such things for every application that might 
make use of them.

Steve