Hi all,
I have a question about the messages and responses detailed in the
rescert-provisioning draft.
In particular I was considering the use-case where a client requests a
new certificate and the issuer needs time to process the request; e.g.
because a human step is involved like fips-140-2 level 3 authentication
when signing.
Looking at the draft it seems to me that an issuer can either respond to
a request immediately, or give back a 'Request-Not-Performed' response
as defined in section 3.6. The http request can be kept open for some
time needed to respond, but that does not stretch long enough for this
type of operation.
So, in this case, where the issuer is unable to process the request
synchronously a response with code '1101' ('already processing request')
could be returned. I do not see a more elegant way at this time. However
I feel that the error code is not a 100% match to what the issuer would
want to say in this case. I would prefer to have some response in the
line of: request received, please come back later. Possibly even
including a hint about when 'later' .
E.g. something like:
1204 - request - request recieved, response pending
Then if the client comes back later asking for a certificate with the
same properties it should be possible for the issuer to give the proper
response -- provided the client does not come back too soon of course..
in which case code 1101 matches.
What do people think? Is there already something for this in the draft
that I just missed? Is it okay to just use code '1101' for this? And if
not, is it desirable to add this?
Cheers,
Tim
Tim Bruijnzeels
Senior Software Engineer
RIPE NCC
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
