Subject: [websec] #42: STS exception for CRL fetching

From: "websec issue tracker" <[email-masked]>
Date: Mon, 26 Mar 2012 07:22:07 -0000

#42: STS exception for CRL fetching

 https://www.ietf.org/mail-archive/web/websec/current/msg01093.html - yoav
 nir

 Section 10.3 discusses the case where the server or some subdomain also
 hosts CRLs or OCSP and suggests some work-around to the "all TCP" port
 requirement. Fetching CRLs is a different context than rendering a web
 page. I think the suggestions should be removed and a sentence added that
 says that the STS policy does not apply to fetching of revocation
 information by the browser. I think this would be far easier to implement.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  draft-ietf-websec-strict-transport-
  jeff.hodges@…          |  sec@…
     Type:  enhancement  |     Status:  new
 Priority:  major        |  Milestone:
Component:  strict-      |    Version:
  transport-sec          |   Keywords:
 Severity:  In WG Last   |
  Call                   |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/42>
websec <http://tools.ietf.org/websec/>

---

From: "websec issue tracker" <[email-masked]>
Date: Tue, 27 Mar 2012 17:43:04 -0000

Comment (by tobias.gondrom@…):

 just a personal comment:
 Just to be complete: CRL fetching does not necessarily mean a complete
 break of HSTS if CRLs come from the same server. A server could still use
 HSTS without the subdomain directive and publish the CRLs/OCSP on a
 different subdomain. Though I admit that would be a significant limitation
 of HSTS. :-(

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-websec-strict-
  jeff.hodges@…          |  transport-sec@…
     Type:  enhancement  |      Status:  new
 Priority:  major        |   Milestone:
Component:  strict-      |     Version:
  transport-sec          |  Resolution:
 Severity:  In WG Last   |
  Call                   |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/websec/trac/ticket/42#comment:1>
websec <http://tools.ietf.org/websec/>