Re: [TLS] TLS document status update

[Mike <mike-list@xxxxxxxxx>]

>> There is the problem of the client knowing when its certificate is
>> updated and that it should retrieve a new copy to recalculate the
>> hash.  It could keep track of its own validity period, but that
>> complicates things, and wouldn't work if the CA decides to reissue
>> a certificate early.
> 
> Polling occasionally hardly seems like an insuperable barrier.

Another problem is if the client merely polls the URL to obtain the
certificate to calculate the hash without verifying that the cert.
is correct.  And how can it know if the certificate is correct w/o
having its own copy?  This extension could just be a big can of
worms.

Mike
_______________________________________________
TLS mailing list
TLS@xxxxxxxx
https://www.ietf.org/mailman/listinfo/tls