One of the changes in the diff that I thought I had raised, but got no discussion was enrollstatus.
There are two telemetry status reports that BRSKI added .. "to EST". The first is the /.well-known/est/voucher_status. This is a report on whether the voucher was acceptable. This is entirely RFC8366/BRSKI content, and is completely independant of the certificate enrollment protocol. It should change to /.well-known/brski/voucher_status. The second one, described in section 5.9.4 is about whether or not the certificate was enrolled correctly. This provides feedback about whether or not the new certificate was retrieved and installed correctly. It says to use the new certificate and report. It's not that interesting when there is success. It's more interesting when there is a failure of some kind. As such, it is unclear to me if this is tied up in EST only, or whether this is really a BRSKI thing. It's not BRSKI/RFC8366 that failed, it's EST/CMP/SCEP/pixie-dust that failed. It seems that moving it to /brski is acceptable, but it might be that it should remain in /est. I am not steeped in the art of CMP or SCEP or ???, so I don't know if what we've done for EST will translate well. I do not feel strongly either way, but in the diff I left a ?XXX because I didn't know. I am sorry to bring this up during the IETF last-call: I think that I just need some confirmation from CMP experts that we aren't creating something that is unimplementable. -- Michael Richardson <[email protected]> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide
signature.asc
Description: PGP signature
_______________________________________________ Anima mailing list [email protected] https://www.ietf.org/mailman/listinfo/anima
