Respond to some of Steve Kent's comments

Respond to some of Steve Kent's comments

[Eran, 2014-07-10 13:49:52]

LGTM modulu the issue of figuring out which SCT belong to which certificate in
the chain.

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml
File rfc6962-bis.xml (right):

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode402
rfc6962-bis.xml:402: <spanx style="verb">certificate_chain</spanx> is a chain of
additional certificates required to verify the end-entity certificate. The first
certificate MUST certify the end-entity certificate. Each following certificate
MUST directly certify the one preceding it. The final certificate MUST either be
a root certificate accepted by the log, or chain to one.
I assume 'chain to one' means 'directly chain' ?

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode415
rfc6962-bis.xml:415: often only accessible within the enterprise's private
network, it's common for
Remove the reference to enterprises in this sentence as well, since you've
removed it from others.

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode605
rfc6962-bis.xml:605: The SCT data corresponding to at least one certificate in
the chain from at
How does a client match SCTs from OCSP stapling on the TLS handshake to a
certificate, in this case?

[Ben Laurie (Google), 2014-07-10 14:19:36]

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml
File rfc6962-bis.xml (right):

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode402
rfc6962-bis.xml:402: <spanx style="verb">certificate_chain</spanx> is a chain of
additional certificates required to verify the end-entity certificate. The first
certificate MUST certify the end-entity certificate. Each following certificate
MUST directly certify the one preceding it. The final certificate MUST either be
a root certificate accepted by the log, or chain to one.
On 2014/07/10 13:49:51, Eran wrote:
> I assume 'chain to one' means 'directly chain' ? 

Done.

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode415
rfc6962-bis.xml:415: often only accessible within the enterprise's private
network, it's common for
On 2014/07/10 13:49:51, Eran wrote:
> Remove the reference to enterprises in this sentence as well, since you've
> removed it from others.

Done.

https://codereview.appspot.com/113730043/diff/1/rfc6962-bis.xml#newcode605
rfc6962-bis.xml:605: The SCT data corresponding to at least one certificate in
the chain from at
On 2014/07/10 13:49:51, Eran wrote:
> How does a client match SCTs from OCSP stapling on the TLS handshake to a
> certificate, in this case? 

Trial and error, I guess. But note that is not a new issue - add a Trac ticket?

[Eran, 2014-07-10 15:36:49]

LGTM