[pkix] Re: [Errata Held for Document Update] RFC5280 ( 8789)

Corey Bonnell <[email protected]> Tue, 3 Mar 2026 19:38:23 +0000
Newsgroups	gmane.ietf.x509
Message-ID	<DS0PR14MB6216DE834E8A5A373EFAD9A4927FA@DS0PR14MB6216.namprd14.prod.outlook.com>
--===============7722135768593099063==
Content-Language: en-US
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
 micalg=2.16.840.1.101.3.4.2.1;
 boundary="----=_NextPart_000_0046_01DCAB1B.628F56E0"

------=_NextPart_000_0046_01DCAB1B.628F56E0
Content-Type: text/plain;
	charset="UTF-8"
Content-Transfer-Encoding: 7bit

I'm confused. Isn't this erratum a duplicate of the verified, technical 
erratum https://www.rfc-editor.org/errata/eid5802?

-----Original Message-----
From: RFC Errata System <[email protected]>
Sent: Tuesday, March 3, 2026 12:34 PM
To: [email protected]; [email protected]; [email protected]; 
[email protected]; [email protected]; [email protected]; 
[email protected]
Cc: [email protected]; [email protected]; [email protected]; 
[email protected]
Subject: [pkix] [Errata Held for Document Update] RFC5280 (8789)

The following errata report has been held for document update for RFC5280, 
"Internet X.509 Public Key Infrastructure Certificate and Certificate 
Revocation List (CRL) Profile".

--------------------------------------
You may review the report below and at:
https://www.rfc-editor.org/errata/eid8789

--------------------------------------
Status: Held for Document Update
Type: Editorial

Reported by: Elizabeth Peraza Slator <[email protected]> Date 
Reported: 2026-02-28 Held by: Paul Wouters (IESG)

Section: GLOBAL

Original Text
-------------
Section 4.2.1.12 says:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS WWW server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS WWW client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
It should say:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
Notes:

The proposed change removes the WWW part of the description. In practice these 
object identifiers are used for server and client applications, but not 
necessarily web applications. In particular:
- openssl verification considers them unconditionally even if the server is 
not a web server or the client a web client
- There is no object identifier that can be used for protocols like SMTP, 
IMAP, POP3, LDAP, radius, ...; in practice all these protocols are deployed 
with the identifiers for WWW
- Standards like common criteria assume that these object identifiers are for 
generic server and clients [0].

[0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1

Report New Errata

Corrected Text
--------------
Section 4.2.1.12 says:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS WWW server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS WWW client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
It should say:

   id-kp-serverAuth             OBJECT IDENTIFIER ::= { id-kp 1 }
   -- TLS server authentication
   -- Key usage bits that may be consistent: digitalSignature,
   -- keyEncipherment or keyAgreement

   id-kp-clientAuth             OBJECT IDENTIFIER ::= { id-kp 2 }
   -- TLS client authentication
   -- Key usage bits that may be consistent: digitalSignature
   -- and/or keyAgreement
Notes:

The proposed change removes the WWW part of the description. In practice these 
object identifiers are used for server and client applications, but not 
necessarily web applications. In particular:
- openssl verification considers them unconditionally even if the server is 
not a web server or the client a web client
- There is no object identifier that can be used for protocols like SMTP, 
IMAP, POP3, LDAP, radius, ...; in practice all these protocols are deployed 
with the identifiers for WWW
- Standards like common criteria assume that these object identifiers are for 
generic server and clients [0].

[0]. https://www.niap-ccevs.org/MMO/PP/-442-/#FCS_TLSC_EXT.1.1

Report New Errata

Notes
-----
Sec AD (Paul Wouters): Changed to Editorial,  as the suggested changes are in 
an ASN.1 comment

--------------------------------------
RFC5280 (draft-ietf-pkix-rfc3280bis-11)
--------------------------------------
Title               : Internet X.509 Public Key Infrastructure Certificate and 
Certificate Revocation List (CRL) Profile
Publication Date    : May 2008
Author(s)           : D. Cooper, S. Santesson, S. Farrell, S. Boeyen, R. 
Housley, W. Polk
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
pkix mailing list -- [email protected]
To unsubscribe send an email to [email protected]

------=_NextPart_000_0046_01DCAB1B.628F56E0
Content-Type: application/pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCD/gw
ggOWMIICfqADAgECAhALkxw61jln6mcjv8OvmvRLMA0GCSqGSIb3DQEBCwUAMGUxCzAJBgNVBAYT
AlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAi
BgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBHMjAeFw0xMzA4MDExMjAwMDBaFw0zODAx
MTUxMjAwMDBaMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsT
EHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBHMjCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANnnKC9SPzZySYiTNPP4ah4xVICfrVRBtUff
lqjUr4AtuQrPdf2JpX0k+uMiDCu8lRcLM78ZTUEGkAC9DE0Q/ge15xxuIlUxZZe90xfSHmLz2+ps
UIw/hAyWz7fLA+DKbaEUTBuJ3e0AsFJ8r5FssTgT0ekSCMAAsBwrEdp3cDabrs55h9yCcOYJdHBV
aa+jaJ+/3bZ5s/KdcClV9Kv/lWHzyUBvHdG+k7vTiCq7nb9yWlZxOz/U89EK/ijvo+7Zma8D049g
t/KSobG9iYkfMM3Dpi5iM64WAndEWueBCjynRC55uD8EvFygh+Ebr1GOzews+vj+bfA6fKqL5GeV
MY0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0OBBYEFM7D
SrmZVfK422C/qX69VrWXNqfWMA0GCSqGSIb3DQEBCwUAA4IBAQDKpVWM48hBbmknp3UR7zyGNm/S
ncZ4OB1plqKSaS44bJt9BNSJpbExN4rJIcyrbM2LHJrWv0jSMmbBisDzLzrvwOPUkYbRUOMD23N3
b0o5U+3eJse1fa8rQtF1YuNKKwLHUEvgaeKWbA5EZhBEj60F6/h5rKYb6Dc0nVPJYaqiUq9KcBaG
wjrIsRNwNtjP7vQKNNVbTP0HnKK62QFyXPNNwd0OsRwNxGO+rfQU+4nsokEOTMzIV0DQbgOqzQyO
iZmZbPA8MK8432+8o74pICerdP8TInjel1JVHoO1VCAD7q7AT1beN8zDf6oEJ7vTd7hi2xd8nCgi
E3Nszyb1iinnMIIFrzCCBJegAwIBAgIQDZDijEphl4ReXjJdK7EYbzANBgkqhkiG9w0BAQwFADBl
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNl
cnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1cmVkIElEIFJvb3QgRzIwHhcNMjQwMzEzMDAw
MDAwWhcNMzQwMzEyMjM1OTU5WjBiMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIElu
Yy4xOjA4BgNVBAMTMURpZ2lDZXJ0IEFzc3VyZWQgRzIgU01JTUUgUlNBNDA5NiBTSEEzODQgMjAy
NCBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDn0iHgtL79cT0PnYEsWyCK5Gq7
urJAFiWGhhc5r6uCqvtsFNo8YXFpSYPyXj+YxJKvyzN6Z+Wmi2qO/Y/l0ZkuydWaSSlDgyVaDOLP
TECYUzL6OKkuWUuuIOkEezm5M9yNS692lnkgZgwxMs7nvjSrblmdQsct0XV6P8OR4EXN5dgHq3Dj
NxrdV6J08xLU22fx8HNEp/Rs/EZhkSuimuIVQ5fKv9pdddCmldt9yoeXrT9HLF0vDCDHVUX0bt7H
OYaddwxu5Qisyu9mthhKSPFqZduhuiNfyzM8//fE/hao06sbHarpOwo+5tryhi1tQaK6UB+1hRj3
SUFyXtYX234mQAnFXQrZeJwGnBWnJrIgK2QX1+wEBi+4rLx1MMGBRLXAKchluKdi7frfJ71NAgDQ
OgRzqTs9cTj/FpgBEm1K4iI8rk1H93yfaAzQrq1aoQEjCQg2liN5WF/0AKIgM7empKm22caNro1u
5hhqnNCsahNnLIdk+/b+6QvGlLRwX8Da00dfRp2VcRNHkO1YiEIUepqUmlEBQPbBvnJg9hvE5woG
LC2tKvA3uhetWggXr0Bhzc622dyQDJ3r3mIPyctV8UBw0XL6zH1intI43Fm3SmJWhlT5uVdSC8GM
+2L+XsKNzVK8SBiYssHvaj4biUg2bO1XoU7iNBcRiLICs1Y4GwIDAQABo4IBXDCCAVgwEgYDVR0T
AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU95uiTtOXxfQ0D0MOgYXOkZMyr/kwHwYDVR0jBBgwFoAU
zsNKuZlV8rjbYL+pfr1WtZc2p9YwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwME
BggrBgEFBQcDAjB5BggrBgEFBQcBAQRtMGswJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2lj
ZXJ0LmNvbTBDBggrBgEFBQcwAoY3aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0
QXNzdXJlZElEUm9vdEcyLmNydDBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2Vy
dC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290RzIuY3JsMBEGA1UdIAQKMAgwBgYEVR0gADANBgkq
hkiG9w0BAQwFAAOCAQEAPm/FMOd7A7KXWYLpFPqsy8sh5HI5cRhoR5T/s65gyyptcBBbwkUtqYpY
tx8uu4vDeDeTVL8OUYOpL95cW/UvUZLcZON5Prb5uvKZezsUBOeWY1WPOz9JVDxsBKjjsCy8h9Nm
UHLH6uaeS6zh/dCb5r2dcsu9x0vlaQwKjpcrRNDUr0yEahRZCkBkMH477apfWH5bo7jTbyc7YwWh
ymGbJzUoPid/KI2KuEz96UoN1HVR9D53FYz0MqsQvcXn+V2nvdim5M6Jd8ezXpdwNW8AJGpawzLK
b0x73sui34gZLBSKr4k56Mu34I2kQCYB0vkV8f3JrkXd61AHJUlVa2LvETCCBqcwggSPoAMCAQIC
EAX13Va0GiQi6VOoD8IsRjswDQYJKoZIhvcNAQELBQAwYjELMAkGA1UEBhMCVVMxFzAVBgNVBAoT
DkRpZ2lDZXJ0LCBJbmMuMTowOAYDVQQDEzFEaWdpQ2VydCBBc3N1cmVkIEcyIFNNSU1FIFJTQTQw
OTYgU0hBMzg0IDIwMjQgQ0ExMB4XDTI1MDYyMzAwMDAwMFoXDTI2MDYyMjIzNTk1OVowgdYxHjAc
BgNVBGETFU5UUlVTK1VULTUyOTk1MzctMDE0MjELMAkGA1UEBhMCVVMxDTALBgNVBAgTBFV0YWgx
DTALBgNVBAcTBExlaGkxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMRAwDgYDVQQEEwdCb25uZWxs
MQ4wDAYDVQQqEwVDb3JleTEjMCEGA1UEAwwaY29yZXkuYm9ubmVsbEBkaWdpY2VydC5jb20xKTAn
BgkqhkiG9w0BCQEWGmNvcmV5LmJvbm5lbGxAZGlnaWNlcnQuY29tMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEA6DeDZ5SUYqPgOxq5M7lsaC82GkNAyetq+9uvq4IhbCNpyBhHOYbwYyqj
026nsOHjlE14OjjkHaW0sXfzswHyP6WgNGR1kvBIpynLYPoqEJYgnJVR21TFEPY02o6bUkK7nlXL
q4nZaALVpN+8bCYtEBULeix+jtPp2cO9uXqHvF4zF7Qw7NbSVBFr4KS1/6DBuSTWb6TTZG71iXK8
JioGedtxAgRGTHWJSpOZ1UYTbXu7hpQnZGvhCZuNhRsB3U9JNluR0RoFIBqTKKWfkdwNP6Dp/ltb
y635NdY/x/AXmkwJLyu+DpV0VYzHa5j267XOcX1PWzV8A/P3q0vwxsHD5QIDAQABo4IB4jCCAd4w
HwYDVR0jBBgwFoAU95uiTtOXxfQ0D0MOgYXOkZMyr/kwHQYDVR0OBBYEFH1yJhe+JWe6DhECl/8Q
Js42LyuJMCUGA1UdEQQeMByBGmNvcmV5LmJvbm5lbGxAZGlnaWNlcnQuY29tMBQGA1UdIAQNMAsw
CQYHZ4EMAQUDAzAOBgNVHQ8BAf8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwQwgakGA1UdHwSB
oTCBnjBNoEugSYZHaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZEcyU01J
TUVSU0E0MDk2U0hBMzg0MjAyNENBMS5jcmwwTaBLoEmGR2h0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNv
bS9EaWdpQ2VydEFzc3VyZWRHMlNNSU1FUlNBNDA5NlNIQTM4NDIwMjRDQTEuY3JsMIGNBggrBgEF
BQcBAQSBgDB+MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wVgYIKwYBBQUH
MAKGSmh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRHMlNNSU1FUlNB
NDA5NlNIQTM4NDIwMjRDQTEuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQAFKHuFfjeJWt5QEGkt+f9F
A+X3IGUpiHgQ+c9ttvpyYBBg+fCMCfnU5vgOrn3HPP9MQGLMuQ4nm5ZARk6iR7gWS/juEvE9gwj6
bnjmq+pStJLkyfQl+aND2cFi3FgO5rY3xgGY42WDqznsGhTwnZw5A3DQEaGx6aEtLJCvWPbTgqS7
EPHy9lyN4j53bI20v24XfEno/WjxEp/7AK8fe0FJuvqWetsYN3FwXHVZoBXlXOWfrAznHIbrPyjz
7BCTPLhCh6eov+cfE9On5R7QrGpiADk2SHngOTct1swpmg2/3VK62N0hj1czU/Qj4Tg7rU+0oZC1
lgnscuz/H4lytYxNheNhPWKYnzsppz7qxhG/ta5ykvPk/Ohf5QekTBYe6nKUOG1qQRr36C04vpkl
dKXQrw6CxjlPilD8dwhFNB34qBBHc0i/sJqGzGYgfQ9sEHYGmZZsGJzrF+rzmS3Gu4f0k3tV9x5C
GKkdD7yz6B4i/+1Aq7LculQFy+/pw+3AOcAUEbaUgtKO0JEXbVbV900KBoJUAyWaErKraUzqMpEf
9ZVEtx0Hdooic0E9dwEzmX5Iz06nsbpHDF4GWSo88bknlqrpk08jjJACGA50iDTfpOa2sx1LSHGs
hjtbUTSHXE2I71D8u8uASiby0mbcAYPDvu3RKRgoQFLpDHK3nPH0YDGCA4swggOHAgEBMHYwYjEL
MAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMTowOAYDVQQDEzFEaWdpQ2VydCBB
c3N1cmVkIEcyIFNNSU1FIFJTQTQwOTYgU0hBMzg0IDIwMjQgQ0ExAhAF9d1WtBokIulTqA/CLEY7
MA0GCWCGSAFlAwQCAQUAoIIB5jAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJ
BTEPFw0yNjAzMDMxOTM4MjJaMC8GCSqGSIb3DQEJBDEiBCDc+ofSxdujzkM1YIrQQByBDQuRIi72
7uSmkNjHxnLs0zBpBgkqhkiG9w0BCQ8xXDBaMAsGCWCGSAFlAwQBKjALBglghkgBZQMEARYwCgYI
KoZIhvcNAwcwCwYJYIZIAWUDBAECMAsGCWCGSAFlAwQCATALBglghkgBZQMEAgMwCwYJYIZIAWUD
BAICMIGFBgkrBgEEAYI3EAQxeDB2MGIxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwg
SW5jLjE6MDgGA1UEAxMxRGlnaUNlcnQgQXNzdXJlZCBHMiBTTUlNRSBSU0E0MDk2IFNIQTM4NCAy
MDI0IENBMQIQBfXdVrQaJCLpU6gPwixGOzCBhwYLKoZIhvcNAQkQAgsxeKB2MGIxCzAJBgNVBAYT
AlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjE6MDgGA1UEAxMxRGlnaUNlcnQgQXNzdXJlZCBH
MiBTTUlNRSBSU0E0MDk2IFNIQTM4NCAyMDI0IENBMQIQBfXdVrQaJCLpU6gPwixGOzANBgkqhkiG
9w0BAQEFAASCAQBZUK/AZ2KJ3ECOenmnsB6JGJ+VYdNN2cqn6b/eumQXGegCdaHmUscAS65QmpKS
bSzycWuZd402H5uR4Tgl7ZT2Yns+aplguX84o/1n4kLDYEXR5nzAcZEY50QLErGW1qj4FikYVKFo
tSobGr/uAPu2bKICCJyphVrAulRxNJ19jQfunCUEHuBMuOUdlIV25vzQxX5LlI2rt+0TfoMnlYRi
amvUCp5Olw/zTN5i+QTk/vdRLKgZTDLjw9/FkyyDtRH6I5ahpMbta+FvSo01nIBswIt3s+kD3rm/
eH+qJWJPoiTTYZtmyvn0Us9ujwVbvJYiKAlRO/k+sIoYrv8ImZZcAAAAAAAA

------=_NextPart_000_0046_01DCAB1B.628F56E0--


--===============7722135768593099063==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KcGtpeCBtYWls
aW5nIGxpc3QgLS0gcGtpeEBpZXRmLm9yZwpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRv
IHBraXgtbGVhdmVAaWV0Zi5vcmcK

--===============7722135768593099063==--