root certificates for TLS

w3c / webmediaporting

Web Media porting spec

1 stars 10 forks source link

root certificates for TLS #12

Open mavgit opened 7 years ago

mavgit commented 7 years ago

From @jpiesing on March 7, 2017 15:31

Web video providers have found it necessary to specify requirements on TLS root certificates that must be supported.

While some lists are proprietary and/or under NDA, an openly available list was defined by the UK DTG based on a subset of the mozilla list. See here for more information http://dtg.org.uk/work/DBook_Resources/dtgrootcert.html .

Should WAVE say something about this?

Copied from original issue: w3c/webmediaapi#45

mavgit commented 7 years ago

From @bbcrddave on April 27, 2017 13:46

Should WAVE say something about this?

I think it probably should, but I'm not sure how this fits into the HATF work. Shouldn't this be a DPCTF issue?

mavgit commented 7 years ago

From @jpiesing on April 27, 2017 14:9

I think it probably should, but I'm not sure how this fits into the HATF work. Shouldn't this be a DPCTF issue?

See my comment elsewhere. Dont' expect DPCTF to address anything other than media-related device capabilities any time soon (ever).

mavgit commented 7 years ago

From @jpiesing on May 16, 2017 17:7

There are two issues;

A minimum set of root certificates for inter-operabilty. We could make such a list (others have done - see http://dtg.org.uk/work/DBook_Resources/dtgrootcert.html )
A maximum set of root certificates for security. While desktop browser vendors will have well established procedures for deciding which certificates they use, do certificates used with device browsers come from the browser vendor or whoever integrates the browser onto the device? HbbTV decided that all root certificates had to be approved for web server authentication on the mozilla list - see http://www.mozilla.org/projects/security/certs/.

This is a hard topic to address in a specification but we shouldn't do nothing just because it's hard.

mavgit commented 7 years ago

From @michelnev on June 12, 2017 20:39

This seems like a policy decision for the deployment ecosystem. Maybe this could be a "should" instead of a "shall" to allow conformance to the security settings of various ecosystems.