rfc9440.original.xml   rfc9440.xml 
<?xml version='1.0' encoding='utf-8'?> <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE rfc [ <!DOCTYPE rfc [
<!ENTITY nbsp "&#160;"> <!ENTITY nbsp "&#160;">
<!ENTITY zwsp "&#8203;"> <!ENTITY zwsp "&#8203;">
<!ENTITY nbhy "&#8209;"> <!ENTITY nbhy "&#8209;">
<!ENTITY wj "&#8288;"> <!ENTITY wj "&#8288;">
]> ]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.9 (Ruby 2.6.1 <rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft
0) --> -ietf-httpbis-client-cert-field-06" number="9440" submissionType="IETF" category
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft ="info" consensus="true" tocInclude="true" sortRefs="true" symRefs="true" xml:la
-ietf-httpbis-client-cert-field-06" category="info" submissionType="IETF" versio ng="en" updates="" obsoletes="" version="3">
n="3">
<!-- xml2rfc v2v3 conversion 3.15.2 -->
<front> <front>
<title abbrev="Client-Cert Header">Client-Cert HTTP Header Field</title> <title abbrev="Client-Cert Header">Client-Cert HTTP Header Field</title>
<seriesInfo name="Internet-Draft" value="draft-ietf-httpbis-client-cert-fiel d-06"/> <seriesInfo name="RFC" value="9440"/>
<author initials="B." surname="Campbell" fullname="Brian Campbell"> <author initials="B." surname="Campbell" fullname="Brian Campbell">
<organization>Ping Identity</organization> <organization>Ping Identity</organization>
<address> <address>
<email>bcampbell@pingidentity.com</email> <email>bcampbell@pingidentity.com</email>
</address> </address>
</author> </author>
<author initials="M." surname="Bishop" fullname="Mike Bishop" role="editor"> <author initials="M." surname="Bishop" fullname="Mike Bishop" role="editor">
<organization>Akamai</organization> <organization>Akamai</organization>
<address> <address>
<email>mbishop@evequefou.be</email> <email>mbishop@evequefou.be</email>
</address> </address>
</author> </author>
<date/> <date year="2023" month="July" />
<area>Applications and Real-Time</area> <area>art</area>
<workgroup>HTTP</workgroup> <workgroup>httpbis</workgroup>
<keyword>http</keyword> <keyword>http</keyword>
<keyword>client certificate</keyword> <keyword>client certificate</keyword>
<abstract> <abstract>
<t>This document describes HTTP extension header fields that allow a TLS <t>This document describes HTTP extension header fields that allow a TLS
terminating reverse proxy to convey the client certificate information of a terminating reverse proxy (TTRP) to convey the client certificate
mutually authenticated TLS connection to the origin server in a common and information of a mutually authenticated TLS connection to the origin
predictable manner.</t> server in a common and predictable manner.</t>
</abstract> </abstract>
<note removeInRFC="true">
<name>About This Document</name>
<t>
Status information for this document may be found at <eref target="https
://datatracker.ietf.org/doc/draft-ietf-httpbis-client-cert-field-06/"/>.
</t>
<t>
Discussion of this document takes place on the
HTTP Working Group mailing list (<eref target="mailto:ietf-http-wg@w3.or
g"/>),
which is archived at <eref target="https://lists.w3.org/Archives/Public/
ietf-http-wg/"/>.
Working Group information can be found at <eref target="https://httpwg.o
rg/"/>.
</t>
<t>Source for this draft and an issue tracker can be found at
<eref target="https://github.com/httpwg/http-extensions/labels/client-ce
rt-field"/>.</t>
</note>
</front> </front>
<middle> <middle>
<section anchor="Introduction"> <section anchor="Introduction">
<name>Introduction</name> <name>Introduction</name>
<t>A fairly common deployment pattern for HTTPS applications is to have th e origin <t>A fairly common deployment pattern for HTTPS applications is to have th e origin
HTTP application servers sit behind a reverse proxy that terminates TLS HTTP application servers sit behind a reverse proxy that terminates TLS
connections from clients. The proxy is accessible to the internet and dispatches connections from clients. The proxy is accessible to the Internet and dispatches
client requests to the appropriate origin server within a private or protected client requests to the appropriate origin server within a private or protected
network. The origin servers are not directly accessible by clients and are only network. The origin servers are not directly accessible by clients and are only
reachable through the reverse proxy. The backend details of this type of reachable through the reverse proxy. The backend details of this type of
deployment are typically opaque to clients who make requests to the proxy server deployment are typically opaque to clients who make requests to the proxy server
and see responses as though they originated from the proxy server itself. and see responses as though they originated from the proxy server itself.
Although HTTPS is also usually employed between the proxy and the origin server, Although HTTPS is also usually employed between the proxy and the origin server,
the TLS connection that the client establishes for HTTPS is only between itself the TLS connection that the client establishes for HTTPS is only between itself
and the reverse proxy server.</t> and the reverse proxy server.</t>
<t>The deployment pattern is found in a number of varieties such as n-tier <t>The deployment pattern is found in a number of varieties such as n-tier
architectures, content delivery networks, application load balancing services, architectures, content delivery networks, application load-balancing services,
and ingress controllers.</t> and ingress controllers.</t>
<t>Although not exceedingly prevalent, TLS client certificate authenticati <t>Although not exceedingly prevalent, TLS client certificate
on is authentication is sometimes employed, and in such cases the origin
sometimes employed and in such cases the origin server often requires server often requires information about the client certificate for its
information about the client certificate for its application logic. Such logic application logic. Such logic might include access control decisions,
might include access control decisions, audit logging, and binding issued tokens audit logging, and binding issued tokens or cookies to a certificate, incl
or cookies to a certificate, and the respective validation of such bindings. The uding
specific details from the certificate needed also vary with the application the respective validation of such bindings. The specific details
requirements. In order for these types of application deployments to work in needed from the certificate also vary with the application
practice, the reverse proxy needs to convey information about the client requirements. In order for these types of application deployments to
certificate to the origin application server. At the time of writing, a common w work in practice, the reverse proxy needs to convey information about
ay this information is the client certificate to the origin application server. At the time of
conveyed is by using non-standard fields to carry the writing, a common way this information is conveyed is by using
certificate (in some encoding) or individual parts thereof in the HTTP request non-standard fields to carry the certificate (in some encoding) or
that is dispatched to the origin server. This solution works but individual parts thereof in the HTTP request that is dispatched to the
interoperability between independently developed components can be cumbersome or origin server. This solution works, but interoperability between
even impossible depending on the implementation choices respectively made (like independently developed components can be cumbersome or even impossible
what field names are used or are configurable, which parts of the certificate depending on the implementation choices respectively made (like what
are exposed, or how the certificate is encoded). A well-known predictable field names are used or are configurable, which parts of the certificate
approach to this commonly occurring functionality could improve and simplify are exposed, or how the certificate is encoded). A well-known
interoperability between independent implementations.</t> predictable approach to this commonly occurring functionality could
<t>The scope of this document is to describe existing practice while codif improve and simplify interoperability between independent
ying specific implementations.</t>
details sufficient to facilitate improved and lower-touch interoperability.
As such, this document describes two HTTP header fields, <tt>Client-Cert</tt> <t>The scope of this document is to describe existing practice while
and <tt>Client-Cert-Chain</tt>, which a TLS terminating reverse proxy (TTRP) ad codifying specific details sufficient to facilitate improved and
ds to lower-touch interoperability. As such, this document describes two HTTP
requests sent to the backend origin servers. The <tt>Client-Cert</tt> field valu header fields, "Client-Cert" and "Client-Cert-Chain",
e which a TLS terminating reverse proxy (TTRP) adds to requests sent to
contains the end-entity client certificate from the mutually authenticated TLS the backend origin servers. The Client-Cert field value
connection between the originating client and the TTRP. Optionally, the contains the end-entity client certificate from the mutually
<tt>Client-Cert-Chain</tt> field value contains the certificate chain used for authenticated TLS connection between the originating client and the
validation of the end-entity certificate. This enables the backend origin TTRP. Optionally, the Client-Cert-Chain field value contains
server to utilize the client certificate the certificate chain used for validation of the end-entity
information in its application logic. While there may be additional proxies or certificate. This enables the backend origin server to utilize the
hops between the TTRP and the origin server (potentially even with client certificate information in its application logic. While there may
mutually authenticated TLS connections between them), the scope of the be additional proxies or hops between the TTRP and the origin server
<tt>Client-Cert</tt> header field is intentionally limited to exposing to the or (potentially even with mutually authenticated TLS connections between
igin them), the scope of the Client-Cert header field is
server the certificate that was presented by the originating client in its intentionally limited to exposing to the origin server the certificate
connection to the TTRP.</t> that was presented by the originating client in its connection to the
TTRP.</t>
<section anchor="requirements-notation-and-conventions"> <section anchor="requirements-notation-and-conventions">
<name>Requirements Notation and Conventions</name> <name>Requirements Notation and Conventions</name>
<t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp <t>
14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQU
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECO IRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
MMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>", NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be i RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
nterpreted as "<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and be interpreted as
only when, they described in BCP&nbsp;14 <xref target="RFC2119"/> <xref target="RFC8174"/>
appear in all capitals, as shown here.</t> when, and only when, they appear in all capitals, as shown here.
</t>
</section> </section>
<section anchor="terminology-and-applicability"> <section anchor="terminology-and-applicability">
<name>Terminology and Applicability</name> <name>Terminology and Applicability</name>
<t>This document uses the following terminology from <xref section="3" s <t>This document uses the following terminology from <xref section="3" se
ectionFormat="of" target="RFC8941"/> ctionFormat="of"
to specify syntax and parsing: List and Byte Sequence.</t> target="RFC8941"/> to specify syntax and parsing: List
<t>Phrases like TLS client certificate authentication or mutually authen and Byte Sequence.</t>
ticated TLS <t>Phrases like "TLS client certificate authentication" or "mutually
are used throughout this document to refer to the process whereby, in addition authenticated TLS" are used throughout this document to refer to the
to the normal TLS server authentication with a certificate, a client presents process whereby, in addition to the normal TLS server authentication
its X.509 certificate <xref target="RFC5280"/> and proves possession of the corr with a certificate, a client presents its X.509 certificate <xref
esponding target="RFC5280"/> and proves possession of the corresponding private
private key to a server when negotiating a TLS connection or the resumption of key to a server when negotiating a TLS connection or the resumption of
such a connection. In contemporary versions of TLS <xref target="TLS"/> such a connection.
<xref target="TLS1.2"/> this requires that the client send the Certifi In contemporary versions of TLS <xref
cate and target="RFC8446"/> <xref target="RFC5246"/>, mutual authentication requi
CertificateVerify messages during the handshake and for the server to verify the res the client to send
CertificateVerify and Finished messages.</t> the Certificate and CertificateVerify messages during the handshake
<t>HTTP/2 restricts TLS 1.2 renegotiation (<xref section="9.2.1" section and the server to verify the CertificateVerify and Finished
Format="of" target="RFC9113"/>) and messages.</t>
prohibits TLS 1.3 post-handshake authentication (<xref section="9.2.3" sectionFo <t>HTTP/2 restricts TLS 1.2 renegotiation (<xref section="9.2.1"
rmat="of" target="RFC9113"/>). However, they are sectionFormat="of" target="RFC9113"/>) and prohibits TLS 1.3
sometimes used to implement reactive client certificate authentication in HTTP/1 post-handshake authentication (<xref section="9.2.3"
.1 sectionFormat="of" target="RFC9113"/>). However, they are sometimes
<xref target="RFC9112"/> where the server decides whether to request a client ce used to implement reactive client certificate authentication in
rtificate HTTP/1.1 <xref target="RFC9112"/> where the server decides whether to
based on the HTTP request. HTTP application data sent on such a connection request a client certificate based on the HTTP request. HTTP
after receipt and verification of the client certificate is also application data sent on such a connection after receipt and
mutually authenticated and thus suitable for the mechanisms described in this verification of the client certificate is also mutually authenticated
document. With post-handshake authentication there is also the possibility, thou and thus suitable for the mechanisms described in this
gh document. With post-handshake authentication, there is also the
unlikely in practice, of multiple certificates and certificate chains from the possibility, though unlikely in practice, of multiple certificates and
client on a connection, in which case only the certificate and chain certificate chains from the client on a connection. In this case, only
of the last post-handshake authentication are to be utilized for the header the certificate and chain of the last post-handshake authentication
fields described herein.</t> are to be utilized for the header fields described herein.</t>
</section> </section>
</section> </section>
<section anchor="headers"> <section anchor="headers">
<name>HTTP Header Fields and Processing Rules</name> <name>HTTP Header Fields and Processing Rules</name>
<t>This document designates the following headers, defined further in <xre <t>This document designates the following headers, defined further in
f target="header"/> Sections <xref target="header" format="counter"/> and <xref target="chain-
and <xref target="chain-header"/> respectively, to carry the client certificate header" format="counter"/>, respectively,
information of a to carry the client certificate information of a mutually authenticated
mutually authenticated TLS connection. The headers convey the information TLS connection. The headers convey the information from the reverse
from the reverse proxy to the origin server.</t> proxy to the origin server.</t>
<dl> <dl spacing="normal" newline="true">
<dt>Client-Cert:</dt> <dt>Client-Cert:</dt>
<dd> <dd>The end-entity certificate used by the client in the TLS handshake
<t>The end-entity certificate used by the client in the TLS handshake with the reverse proxy. </dd>
with
the reverse proxy.</t>
</dd>
<dt>Client-Cert-Chain:</dt> <dt>Client-Cert-Chain:</dt>
<dd> <dd>The certificate chain used for validation of the end-entity
<t>The certificate chain used for validation of the end-entity certificate provided by the client in the TLS handshake with the
certificate provided by the client in the TLS handshake with the reverse proxy.< reverse proxy.</dd>
/t>
</dd>
</dl> </dl>
<section anchor="encoding"> <section anchor="encoding">
<name>Encoding</name> <name>Encoding</name>
<t>The headers in this document encode certificates as Byte <t>The headers in this document encode certificates as Byte Sequences
Sequences (<xref section="3.3.5" sectionFormat="of" target="RFC8941"/>) where th (<xref section="3.3.5" sectionFormat="of" target="RFC8941"/>) where
e value of the binary data the value of the binary data is a DER-encoded <xref
is a DER encoded <xref target="ITU.X690.1994"/> X.509 certificate <xref target=" target="ITU.X690"/> X.509 certificate <xref target="RFC5280"/>.
RFC5280"/>. In effect, this means that the binary DER certificate is encoded using
In effect, this means that the binary DER certificate is encoded using base64 base64 (without line breaks, spaces, or other characters outside the
(without line breaks, spaces, or other characters outside the base64 alphabet) base64 alphabet) and delimited with colons on either side.</t>
and delimited with colons on either side.</t>
<t>Note that certificates are often stored encoded in a textual format, <t>Note that certificates are often stored in an encoded textual
such as format, such as the one described in <xref section="5.1"
the one described in <xref section="5.1" sectionFormat="of" target="RFC7468"/>, sectionFormat="of" target="RFC7468"/>, which is already nearly
which is already nearly compatible with a Byte Sequence. If certificates are encoded as such, it
compatible with a Byte Sequence; if so, it will be sufficient to replace will be sufficient to
<tt>---(BEGIN|END) CERTIFICATE---</tt> with <tt>:</tt> and remove line breaks in replace "---(BEGIN|END) CERTIFICATE---" with ":" and
order remove line breaks in order to generate an appropriate item.</t>
to generate an appropriate item.</t>
</section> </section>
<section anchor="header"> <section anchor="header">
<name>Client-Cert HTTP Header Field</name> <name>Client-Cert HTTP Header Field</name>
<t>In the context of a TLS terminating reverse proxy deployment, the pro <t>In the context of a TLS terminating reverse proxy deployment, the
xy proxy makes the TLS client certificate available to the backend
makes the TLS client certificate available to the backend application with the application with the Client-Cert HTTP header field. This field
Client-Cert HTTP header field. This field contains the end-entity certificate contains the end-entity certificate used by the client in the TLS
used by the client in the TLS handshake.</t> handshake.</t>
<t>Client-Cert is a Byte Sequence with the value of <t>Client-Cert is a Byte Sequence with the value of the header
the header encoded as described in <xref target="encoding"/>.</t> encoded as described in <xref target="encoding"/>.</t>
<t>The <tt>Client-Cert</tt> header field is only for use in HTTP request <t>The Client-Cert header field is only for use in HTTP
s and <bcp14>MUST NOT</bcp14> be requests and <bcp14>MUST NOT</bcp14> be used in HTTP responses. It is
used in HTTP responses. It is a singleton header field value as defined in a singleton header field value as defined in <xref section="5.5"
<xref section="5.5" sectionFormat="of" target="RFC9110"/>, which <bcp14>MUST NOT sectionFormat="of" target="RFC9110"/>, which <bcp14>MUST NOT</bcp14>
</bcp14> have a list of values or occur have a list of values or occur multiple times in a request.</t>
multiple times in a request.</t> <t><xref target="example-header"/> in <xref target="example"/> has an ex
<t><xref target="example-header"/> in <xref target="example"/> has an ex ample of the Client-Cert header field.</t>
ample of the <tt>Client-Cert</tt> header field.</t>
</section> </section>
<section anchor="chain-header"> <section anchor="chain-header">
<name>Client-Cert-Chain HTTP Header Field</name> <name>Client-Cert-Chain HTTP Header Field</name>
<t>In the context of a TLS terminating reverse proxy deployment, the pro xy <t>In the context of a TLS terminating reverse proxy deployment, the pro xy
<bcp14>MAY</bcp14> make the certificate chain <bcp14>MAY</bcp14> make the certificate chain
available to the backend application with the Client-Cert-Chain HTTP header available to the backend application with the Client-Cert-Chain HTTP header
field.</t> field.</t>
<t>Client-Cert-Chain is a List (<xref section="3.1" sectionFormat="of" t <t>Client-Cert-Chain is a List (<xref section="3.1" sectionFormat="of" target="R
arget="RFC8941"/>). Each item in the FC8941"/>). Each item in the
list <bcp14>MUST</bcp14> be a Byte Sequence encoded as described in <xref target List <bcp14>MUST</bcp14> be a Byte Sequence encoded as described in <xref target
="encoding"/>. The order ="encoding"/>. The order
is the same as the ordering in TLS (such as described in <xref section="4.4.2" s is the same as the ordering in TLS (as described in <xref section="4.4.2" sectio
ectionFormat="of" target="TLS"/>).</t> nFormat="of" target="RFC8446"/>).</t>
<t>Client-Cert-Chain <bcp14>MUST NOT</bcp14> appear unless Client-Cert i s also present, and it does <t>Client-Cert-Chain <bcp14>MUST NOT</bcp14> appear unless Client-Cert i s also present, and it does
not itself include the end-entity certificate that is already present in Client- Cert. not itself include the end-entity certificate that is already present in Client- Cert.
The root certificate <bcp14>MAY</bcp14> be omitted from Client-Cert-Chain, provi ded that the target The root certificate <bcp14>MAY</bcp14> be omitted from Client-Cert-Chain, provi ded that the target
origin server is known to possess the omitted trust anchor.</t> origin server is known to possess the omitted trust anchor.</t>
<t>The <tt>Client-Cert-Chain</tt> header field is only for use in HTTP r equests and <bcp14>MUST <t>The Client-Cert-Chain header field is only for use in HTTP requests a nd <bcp14>MUST
NOT</bcp14> be used in HTTP responses. It <bcp14>MAY</bcp14> have a list of val ues or occur multiple NOT</bcp14> be used in HTTP responses. It <bcp14>MAY</bcp14> have a list of val ues or occur multiple
times in a request. For header compression purposes, it might be advantageous times in a request. For header compression purposes, it might be advantageous
to split lists into multiple instances.</t> to split lists into multiple instances.</t>
<t><xref target="example-chain-header"/> in <xref target="example"/> has an example of the <tt>Client-Cert-Chain</tt> header field.</t> <t><xref target="example-chain-header"/> in <xref target="example"/> has an example of the Client-Cert-Chain header field.</t>
</section> </section>
<section anchor="processing-rules"> <section anchor="processing-rules">
<name>Processing Rules</name> <name>Processing Rules</name>
<t>This section outlines the applicable processing rules for a TLS termi <t>This section outlines the applicable processing rules for a TTRP
nating that has negotiated a mutually authenticated TLS connection to convey
reverse proxy (TTRP) that has negotiated a mutually authenticated TLS connection the client certificate from that connection to the backend origin
to convey the client certificate from that connection to the backend origin servers. This technique is to be used as a configuration or deployment
servers. Use of the technique is to be a configuration or deployment option and option, and the processing rules described herein are for servers
the processing rules described herein are for servers operating with that option operating with that option enabled.</t>
enabled.</t> <t>A TTRP negotiates the use of a mutually authenticated TLS
<t>A TTRP negotiates the use of a mutually authenticated TLS connection connection with the client, such as is described in <xref
with the target="RFC8446"/> or <xref target="RFC5246"/>, and validates the
client, such as is described in <xref target="TLS"/> or <xref target="TLS1.2"/>, client certificate per its policy and trusted certificate authorities.
and validates the Each HTTP request on the underlying TLS connection is dispatched to
client certificate per its policy and trusted certificate authorities. Each the origin server with the following modifications:</t>
HTTP request on the underlying TLS connection is dispatched to the origin
server with the following modifications:</t> <ol spacing="normal" type="1">
<ol spacing="normal" type="1"><li>The client certificate is placed in th <li>The client certificate is placed in the Client-Cert
e <tt>Client-Cert</tt> header field of the header field of the dispatched request, as described in <xref
dispatched request, as described in <xref target="header"/>.</li> target="header"/>.</li>
<li>If so configured, the validation chain of the client certificate i <li>If so configured, the validation chain of the client certificate
s placed in is placed in the Client-Cert-Chain header field of the
the <tt>Client-Cert-Chain</tt> header field of the request, as described in request, as described in <xref target="chain-header"/>.</li>
<xref target="chain-header"/>.</li> <li>Any occurrence of the Client-Cert or
<li>Any occurrence of the <tt>Client-Cert</tt> or <tt>Client-Cert-Chai Client-Cert-Chain header fields in the original incoming
n</tt> header fields in request <bcp14>MUST</bcp14> be removed or overwritten before
the original incoming request <bcp14>MUST</bcp14> be removed or overwritten befo forwarding the request. An incoming request that has a
re Client-Cert or Client-Cert-Chain header field
forwarding the request. An incoming request that has a <tt>Client-Cert</tt> or <bcp14>MAY</bcp14> be rejected with an HTTP 400 response.</li>
<tt>Client-Cert-Chain</tt> header field <bcp14>MAY</bcp14> be rejected with an H
TTP 400 response.</li>
</ol> </ol>
<t>Requests to the TTRP made over a TLS connection where the use of clie nt certificate <t>Requests to the TTRP made over a TLS connection where the use of clie nt certificate
authentication was not negotiated <bcp14>MUST</bcp14> be sanitized by removing a ny and all authentication was not negotiated <bcp14>MUST</bcp14> be sanitized by removing a ny and all
occurrences of the <tt>Client-Cert</tt> and <tt>Client-Cert-Chain</tt> header fi elds prior to occurrences of the Client-Cert and Client-Cert-Chain header fields prior to
dispatching the request to the backend server.</t> dispatching the request to the backend server.</t>
<t>Backend origin servers may then use the <tt>Client-Cert</tt> header f <t>Backend origin servers may then use the Client-Cert header
ield of the field of the request to determine if the connection from the client to
request to determine if the connection from the client to the TTRP was the TTRP was mutually authenticated and, if so, the certificate
mutually authenticated and, if so, the certificate thereby presented by the thereby presented by the client. Access control decisions based on
client. the client certificate (or lack thereof) can be conveyed by selecting
Access control decisions based on the client certificate (or lack thereof) can b response content as appropriate or with an HTTP 403 response, if the
e certificate is deemed unacceptable for the given context. Note that
conveyed by selecting response content as appropriate or with an HTTP 403 respon TLS clients that rely on error indications at the TLS layer for an
se, unacceptable certificate will not receive those signals.</t>
if the certificate is deemed unacceptable for the given context. <t>When the value of the Client-Cert request header field is
Note that TLS clients that rely on error indications at the TLS layer for an used to select a response (e.g., the response content is
unacceptable certificate will not receive those signals.</t> access-controlled), the response <bcp14>MUST</bcp14> either be
<t>When the value of the <tt>Client-Cert</tt> request header field is us uncacheable (e.g., by sending Cache-Control: no-store) or be
ed to select a response designated for selective reuse only for subsequent requests with the
(e.g., the response content is access-controlled), the response <bcp14>MUST</bcp same Client-Cert header field value by sending a "Vary:
14> either be Client-Cert" response header. If a TTRP encounters a response
uncacheable (e.g., by sending <tt>Cache-Control: no-store</tt>) or be designated with Client-Cert or Client-Cert-Chain in the Vary header
for field (<xref section="12.5.5" sectionFormat="of"
selective reuse only for subsequent requests with the same <tt>Client-Cert</tt> target="RFC9110"/>), it <bcp14>SHOULD</bcp14> prevent the user agent fro
header value by sending a <tt>Vary: Client-Cert</tt> response header. m caching
If a TTRP encounters a response with a <tt>client-cert</tt> field name in the <t the response by transforming the value of the Vary response
t>Vary</tt> header field to "*".</t>
header field, it <bcp14>SHOULD</bcp14> prevent the user agent from caching the r <t>Forward proxies and other intermediaries <bcp14>MUST NOT</bcp14>
esponse by add the Client-Cert or Client-Cert-Chain header
transforming the value of the <tt>Vary</tt> response header field to <tt>*</tt>. fields to requests or modify an existing Client-Cert or
</t> Client-Cert-Chain header field. Similarly, clients
<t>Forward proxies and other intermediaries <bcp14>MUST NOT</bcp14> add <bcp14>MUST NOT</bcp14> employ the Client-Cert or
the <tt>Client-Cert</tt> or Client-Cert-Chain header field in requests.</t>
<tt>Client-Cert-Chain</tt> header fields to requests, or modify an existing
<tt>Client-Cert</tt> or <tt>Client-Cert-Chain</tt> header field. Similarly, clie
nts <bcp14>MUST NOT</bcp14>
employ the <tt>Client-Cert</tt> or <tt>Client-Cert-Chain</tt> header field in re
quests.</t>
</section> </section>
</section> </section>
<section anchor="deployment"> <section anchor="deployment">
<name>Deployment Considerations</name> <name>Deployment Considerations</name>
<section anchor="header-field-compression"> <section anchor="header-field-compression">
<name>Header Field Compression</name> <name>Header Field Compression</name>
<t>If the connection between the TTRP and origin is capable of field com <t>If the connection between the TTRP and origin is capable of field
pression compression (e.g., HPACK <xref target="RFC7541"/>
(e.g., HPACK <xref target="HPACK"/> or QPACK <xref target="QPACK"/>), and the TT or QPACK <xref target="RFC9204"/>), and the TTRP
RP multiplexes more multiplexes more than one client's requests into that connection, the
than one client's requests into that connection, the size and variation of <tt>C size and variation of Client-Cert and
lient-Cert</tt> and Client-Cert-Chain field values can reduce compression
<tt>Client-Cert-Chain</tt> field values can reduce compression efficiency signif efficiency significantly. An origin could mitigate the efficiency
icantly. loss by increasing the size of the dynamic table. If the TTRP
An origin could mitigate the efficiency loss by increasing the size of the dynam determines that the origin dynamic table is not sufficiently large, it
ic table. may find it beneficial to always send the field value as a literal
If the TTRP determines that the origin dynamic table is not sufficiently large, rather than entering it into the table.</t>
it may find it beneficial to always send the field value as a literal,
rather than entering it into the table.</t>
</section> </section>
<section anchor="message-header-size"> <section anchor="message-header-size">
<name>Message Header Size</name> <name>Message Header Size</name>
<t>A server in receipt of a larger message header than it is willing to <t>A server in receipt of a larger message header than it is willing
handle can send to handle can send an HTTP 431 (Request Header Fields Too Large)
an HTTP 431 (Request Header Fields Too Large) status code per <xref section="5" status code per <xref section="5" sectionFormat="of"
sectionFormat="of" target="RFC6585"/>. target="RFC6585"/>. Due to the typical size of the field values
Due to the typical size of the field values containing certificate data, containing certificate data, recipients may need to be configured to
recipients may need to be configured to allow for a larger maximum header size. allow for a larger maximum header size. An intermediary generating
An intermediary generating client certificate header fields on connections that client certificate header fields on connections that allow for
allow advertising the maximum acceptable header size (e.g., HTTP/2 <xref
for advertising the maximum acceptable header size (e.g., HTTP/2 <xref target="R target="RFC9113"/> or HTTP/3 <xref target="RFC9114"/>) should account fo
FC9113"/> r the additional size of
or HTTP/3 <xref target="RFC9114"/>) should account for the additional size of th the header of the requests it sends, versus the requests it receives,
e header by advertising a value to its clients that is sufficiently smaller so
of the requests it sends vs. requests it receives by advertising a value to its as to allow for the addition of certificate data.</t>
clients that is sufficiently smaller so as to allow for the addition of certific
ate data.</t>
</section> </section>
<section anchor="tls-session-resumption"> <section anchor="tls-session-resumption">
<name>TLS Session Resumption</name> <name>TLS Session Resumption</name>
<t>Some TLS implementations do not retain client certificate information <t>Some TLS implementations do not retain client certificate
when resuming. information when resuming. Providing inconsistent values of
Providing inconsistent values of Client-Cert and Client-Cert-Chain when resuming Client-Cert and Client-Cert-Chain when resuming might lead to errors,
might so implementations that are unable to provide these values
lead to errors, so implementations that are unable to provide these values <bcp1 <bcp14>SHOULD</bcp14> either disable resumption for connections with
4>SHOULD</bcp14> client certificates or initially omit a Client-Cert or
either disable resumption for connections with client certificates or initially Client-Cert-Chain field if it might not be available after
omit a resuming.</t>
<tt>Client-Cert</tt> or <tt>Client-Cert-Chain</tt> field if it might not be avai
lable after resuming.</t>
</section> </section>
</section> </section>
<section anchor="sec"> <section anchor="sec">
<name>Security Considerations</name> <name>Security Considerations</name>
<t>The header fields described herein enable a TTRP and backend or origin <t>The header fields described herein enable a TTRP and backend or
server to origin server to function together as though, from the client's
function together as though, from the client's perspective, they are a single perspective, they are a single logical server-side deployment of HTTPS
logical server-side deployment of HTTPS over a mutually authenticated TLS over a mutually authenticated TLS connection. However, use of the header
connection. Use of the header fields outside that intended use fields outside that intended use case may undermine the protections
case, however, may undermine the protections afforded by TLS client certificate afforded by TLS client certificate authentication. Therefore, steps such
authentication. Therefore, steps such as those described below need to be taken as those described below need to be taken to prevent unintended use,
to prevent unintended use, both in sending the header field and in relying on it both in sending the header field and in relying on its value.</t>
s value.</t> <t>Producing and consuming the Client-Cert and Client-Cert-Chain header
<t>Producing and consuming the <tt>Client-Cert</tt> and <tt>Client-Cert-Ch
ain</tt> header
fields <bcp14>SHOULD</bcp14> be configurable fields <bcp14>SHOULD</bcp14> be configurable
options, respectively, in a TTRP and backend server (or individual application i n options, respectively, in a TTRP and backend server (or in an individual applica tion in
that server). The default configuration for both should be to not use the that server). The default configuration for both should be to not use the
header fields, thus requiring an "opt-in" to the functionality.</t> header fields, thus requiring an "opt-in" to the functionality.</t>
<t>In order to prevent field injection, backend servers <bcp14>MUST</bcp14 > only accept the <t>In order to prevent field injection, backend servers <bcp14>MUST</bcp14 > only accept the
<tt>Client-Cert</tt> and <tt>Client-Cert-Chain</tt> header fields from a trusted Client-Cert and Client-Cert-Chain header fields from a trusted
TTRP (or other proxy in a trusted path TTRP (or other proxy in a trusted path
from the TTRP). A TTRP <bcp14>MUST</bcp14> sanitize the incoming request before forwarding it from the TTRP). A TTRP <bcp14>MUST</bcp14> sanitize the incoming request before forwarding it
on by removing or overwriting any existing instances of the fields. Otherwise, on by removing or overwriting any existing instances of the fields. Otherwise,
arbitrary clients can control the field values as seen and used by the backend arbitrary clients can control the field values as seen and used by the backend
server. It is important to note that neglecting to prevent field injection does server. It is important to note that neglecting to prevent field injection does
not "fail safe" in that the nominal functionality will still work as expected not "fail safe" in that the nominal functionality will still work as expected
even when malicious actions are possible. As such, extra care is recommended in even when malicious actions are possible. As such, extra care is recommended in
ensuring that proper field sanitation is in place.</t> ensuring that proper field sanitation is in place.</t>
<t>The communication between a TTRP and backend server needs to be secured against <t>The communication between a TTRP and backend server needs to be secured against
eavesdropping and modification by unintended parties.</t> eavesdropping and modification by unintended parties.</t>
<t>The configuration options and request sanitization are necessary functi <t>The configuration options and request sanitization are necessary functi
onality onalities
of the respective servers. The other requirements can be met in a number of of the respective servers. The other requirements can be met in a number of
ways, which will vary based on specific deployments. The communication between a ways, which will vary based on specific deployments. The communication between a
TTRP and backend or origin server, for example, might be authenticated in some TTRP and backend or origin server, for example, might be authenticated in some
way with the insertion and consumption of the <tt>Client-Cert</tt> way with the insertion and consumption of the Client-Cert
and <tt>Client-Cert-Chain</tt> header fields occurring and Client-Cert-Chain header fields occurring
only on that connection. only on that connection.
<xref section="B.3" sectionFormat="of" target="I-D.ietf-httpbis-message-signatur es"/> gives one example of <xref section="B.3" sectionFormat="of" target="I-D.ietf-httpbis-message-signatur es"/> gives one example of
this with an application of HTTP Message Signatures. this with an application of HTTP Message Signatures.
Alternatively, the network topology might dictate a Alternatively, the network topology might dictate a
private network such that the backend application is only able to accept private network such that the backend application is only able to accept
requests from the TTRP and the proxy can only make requests to that server. requests from the TTRP and the proxy can only make requests to that server.
Other deployments that meet the requirements set forth herein are also possible. </t> Other deployments that meet the requirements set forth herein are also possible. </t>
</section> </section>
<section anchor="iana-considerations"> <section anchor="iana-considerations">
<name>IANA Considerations</name> <name>IANA Considerations</name>
<section anchor="http-field-name-registrations"> <section anchor="http-field-name-registrations">
<name>HTTP Field Name Registrations</name> <name>HTTP Field Name Registrations</name>
<t>Please register the following entries in the "Hypertext Transfer Prot <t>IANA has registered the following entries in the "Hypertext Transfer
ocol (HTTP) Field Protocol (HTTP) Field Name Registry" defined by "HTTP Semantics" <xref
Name Registry" defined by HTTP Semantics <xref target="RFC9110"/>:</t> target="RFC9110"/>:</t>
<ul spacing="normal">
<li>Field name: Client-Cert</li> <table anchor="table_1">
<li>Status: permanent</li> <name>Hypertext Transfer Protocol (HTTP) Field Name Registry</name>
<li>Specification document: <xref target="headers"/> of [this document <thead>
] <tr>
<br/></li> <th>Field Name</th>
<li>Field name: Client-Cert-Chain</li> <th>Status</th>
<li>Status: permanent</li> <th>Reference</th>
<li>Specification document: <xref target="headers"/> of [this document </tr>
]</li> </thead>
</ul> <tbody>
<tr>
<td>Client-Cert</td>
<td>permanent</td>
<td>RFC 9440, <xref target="headers"/></td>
</tr>
<tr>
<td>Client-Cert-Chain</td>
<td>permanent</td>
<td>RFC 9440, <xref target="headers"/></td>
</tr>
</tbody>
</table>
</section> </section>
</section> </section>
</middle> </middle>
<back> <back>
<displayreference target="RFC8941" to="STRUCTURED-FIELDS"/> <displayreference target="RFC8941" to="STRUCTURED-FIELDS"/>
<displayreference target="RFC9110" to="HTTP"/> <displayreference target="RFC9110" to="HTTP"/>
<displayreference target="RFC9112" to="HTTP/1.1"/> <displayreference target="RFC9112" to="HTTP/1.1"/>
<displayreference target="RFC9113" to="HTTP/2"/> <displayreference target="RFC9113" to="HTTP/2"/>
<displayreference target="RFC9114" to="HTTP/3"/> <displayreference target="RFC9114" to="HTTP/3"/>
<displayreference target="I-D.ietf-httpbis-message-signatures" to="HTTPSIG"/ > <displayreference target="I-D.ietf-httpbis-message-signatures" to="HTTPSIG"/ >
<references> <displayreference target="RFC8446" to="TLS"/>
<displayreference target="RFC9204" to="QPACK"/>
<displayreference target="RFC7541" to="HPACK"/>
<displayreference target="RFC5246" to="TLS1.2"/>
<references>
<name>References</name> <name>References</name>
<references> <references>
<name>Normative References</name> <name>Normative References</name>
<reference anchor="RFC8941">
<front> <!-- [RFC8941] [STRUCTURED-FIELDS] updated to long version because xi:include sh
<title>Structured Field Values for HTTP</title> ows Kamp's name as "P. Kamp" instead of "P-H. Kamp"-->
<author fullname="M. Nottingham" initials="M." surname="Nottingham"> <reference anchor="RFC8941">
<organization/> <front>
</author> <title>Structured Field Values for HTTP</title>
<author fullname="P-H. Kamp" initials="P-H." surname="Kamp"> <author fullname="M. Nottingham" initials="M." surname="Nottingham"/>
<organization/> <author fullname="P-H. Kamp" initials="P-H." surname="Kamp"/>
</author> <date month="February" year="2021"/>
<date month="February" year="2021"/> </front>
<abstract> <seriesInfo name="RFC" value="8941"/>
<t>This document describes a set of data types and associated algo <seriesInfo name="DOI" value="10.17487/RFC8941"/>
rithms that are intended to make it easier and safer to define and handle HTTP h </reference>
eader and trailer fields, known as "Structured Fields", "Structured Headers", or
"Structured Trailers". It is intended for use by specifications of new HTTP fie <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9110.xml"
lds that wish to use a common syntax that is more restrictive than traditional H />
TTP field values.</t> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"
</abstract> />
</front> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"
<seriesInfo name="RFC" value="8941"/> />
<seriesInfo name="DOI" value="10.17487/RFC8941"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.5280.xml"
</reference> />
<reference anchor="RFC9110">
<front> <reference anchor="ITU.X690" target="https://www.itu.int/rec/T-REC-X.690
<title>HTTP Semantics</title> /en">
<author fullname="R. Fielding" initials="R." role="editor" surname="
Fielding">
<organization/>
</author>
<author fullname="M. Nottingham" initials="M." role="editor" surname
="Nottingham">
<organization/>
</author>
<author fullname="J. Reschke" initials="J." role="editor" surname="R
eschke">
<organization/>
</author>
<date month="June" year="2022"/>
<abstract>
<t>The Hypertext Transfer Protocol (HTTP) is a stateless applicati
on-level protocol for distributed, collaborative, hypertext information systems.
This document describes the overall architecture of HTTP, establishes common te
rminology, and defines aspects of the protocol that are shared by all versions.
In this definition are core protocol elements, extensibility mechanisms, and the
"http" and "https" Uniform Resource Identifier (URI) schemes. </t>
<t>This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7
232, 7233, 7235, 7538, 7615, 7694, and portions of 7230.</t>
</abstract>
</front>
<seriesInfo name="STD" value="97"/>
<seriesInfo name="RFC" value="9110"/>
<seriesInfo name="DOI" value="10.17487/RFC9110"/>
</reference>
<reference anchor="RFC2119">
<front>
<title>Key words for use in RFCs to Indicate Requirement Levels</tit
le>
<author fullname="S. Bradner" initials="S." surname="Bradner">
<organization/>
</author>
<date month="March" year="1997"/>
<abstract>
<t>In many standards track documents several words are used to sig
nify the requirements in the specification. These words are often capitalized.
This document defines these words as they should be interpreted in IETF document
s. This document specifies an Internet Best Current Practices for the Internet
Community, and requests discussion and suggestions for improvements.</t>
</abstract>
</front>
<seriesInfo name="BCP" value="14"/>
<seriesInfo name="RFC" value="2119"/>
<seriesInfo name="DOI" value="10.17487/RFC2119"/>
</reference>
<reference anchor="RFC8174">
<front>
<title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</ti
tle>
<author fullname="B. Leiba" initials="B." surname="Leiba">
<organization/>
</author>
<date month="May" year="2017"/>
<abstract>
<t>RFC 2119 specifies common key words that may be used in protoco
l specifications. This document aims to reduce the ambiguity by clarifying tha
t only UPPERCASE usage of the key words have the defined special meanings.</t>
</abstract>
</front>
<seriesInfo name="BCP" value="14"/>
<seriesInfo name="RFC" value="8174"/>
<seriesInfo name="DOI" value="10.17487/RFC8174"/>
</reference>
<reference anchor="RFC5280">
<front>
<title>Internet X.509 Public Key Infrastructure Certificate and Cert
ificate Revocation List (CRL) Profile</title>
<author fullname="D. Cooper" initials="D." surname="Cooper">
<organization/>
</author>
<author fullname="S. Santesson" initials="S." surname="Santesson">
<organization/>
</author>
<author fullname="S. Farrell" initials="S." surname="Farrell">
<organization/>
</author>
<author fullname="S. Boeyen" initials="S." surname="Boeyen">
<organization/>
</author>
<author fullname="R. Housley" initials="R." surname="Housley">
<organization/>
</author>
<author fullname="W. Polk" initials="W." surname="Polk">
<organization/>
</author>
<date month="May" year="2008"/>
<abstract>
<t>This memo profiles the X.509 v3 certificate and X.509 v2 certif
icate revocation list (CRL) for use in the Internet. An overview of this approa
ch and model is provided as an introduction. The X.509 v3 certificate format is
described in detail, with additional information regarding the format and seman
tics of Internet name forms. Standard certificate extensions are described and
two Internet-specific extensions are defined. A set of required certificate ext
ensions is specified. The X.509 v2 CRL format is described in detail along with
standard and Internet-specific extensions. An algorithm for X.509 certificatio
n path validation is described. An ASN.1 module and examples are provided in th
e appendices. [STANDARDS-TRACK]</t>
</abstract>
</front>
<seriesInfo name="RFC" value="5280"/>
<seriesInfo name="DOI" value="10.17487/RFC5280"/>
</reference>
<reference anchor="ITU.X690.1994">
<front> <front>
<title>Information Technology - ASN.1 encoding rules: Specification <title>Information technology - ASN.1 encoding rules:
of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Specification of Basic Encoding Rules (BER), Canonical Encoding
Encoding Rules (DER)</title> Rules (CER) and Distinguished Encoding Rules (DER)</title>
<author> <author>
<organization>International Telecommunications Union</organization > <organization>ITU-T</organization>
</author> </author>
<date year="1994"/> <date month="February" year="2021"/>
</front> </front>
<seriesInfo name="ITU-T" value="Recommendation X.690"/> <seriesInfo name="ITU-T Recommendation" value="X.690"/>
</reference> </reference>
</references> </references>
<references> <references>
<name>Informative References</name> <name>Informative References</name>
<reference anchor="RFC9112">
<front>
<title>HTTP/1.1</title>
<author fullname="R. Fielding" initials="R." role="editor" surname="
Fielding">
<organization/>
</author>
<author fullname="M. Nottingham" initials="M." role="editor" surname
="Nottingham">
<organization/>
</author>
<author fullname="J. Reschke" initials="J." role="editor" surname="R
eschke">
<organization/>
</author>
<date month="June" year="2022"/>
<abstract>
<t>The Hypertext Transfer Protocol (HTTP) is a stateless applicati
on-level protocol for distributed, collaborative, hypertext information systems.
This document specifies the HTTP/1.1 message syntax, message parsing, connectio
n management, and related security concerns. </t>
<t>This document obsoletes portions of RFC 7230.</t>
</abstract>
</front>
<seriesInfo name="STD" value="99"/>
<seriesInfo name="RFC" value="9112"/>
<seriesInfo name="DOI" value="10.17487/RFC9112"/>
</reference>
<reference anchor="RFC9113">
<front>
<title>HTTP/2</title>
<author fullname="M. Thomson" initials="M." role="editor" surname="T
homson">
<organization/>
</author>
<author fullname="C. Benfield" initials="C." role="editor" surname="
Benfield">
<organization/>
</author>
<date month="June" year="2022"/>
<abstract>
<t>This specification describes an optimized expression of the sem
antics of the Hypertext Transfer Protocol (HTTP), referred to as HTTP version 2
(HTTP/2). HTTP/2 enables a more efficient use of network resources and a reduced
latency by introducing field compression and allowing multiple concurrent excha
nges on the same connection.</t>
<t>This document obsoletes RFCs 7540 and 8740.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="9113"/>
<seriesInfo name="DOI" value="10.17487/RFC9113"/>
</reference>
<reference anchor="RFC9114">
<front>
<title>HTTP/3</title>
<author fullname="M. Bishop" initials="M." role="editor" surname="Bi
shop">
<organization/>
</author>
<date month="June" year="2022"/>
<abstract>
<t>The QUIC transport protocol has several features that are desir
able in a transport for HTTP, such as stream multiplexing, per-stream flow contr
ol, and low-latency connection establishment. This document describes a mapping
of HTTP semantics over QUIC. This document also identifies HTTP/2 features tha
t are subsumed by QUIC and describes how HTTP/2 extensions can be ported to HTTP
/3.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="9114"/>
<seriesInfo name="DOI" value="10.17487/RFC9114"/>
</reference>
<reference anchor="I-D.ietf-httpbis-message-signatures">
<front>
<title>HTTP Message Signatures</title>
<author fullname="Annabelle Backman" initials="A." surname="Backman"
>
<organization>Amazon</organization>
</author>
<author fullname="Justin Richer" initials="J." surname="Richer">
<organization>Bespoke Engineering</organization>
</author>
<author fullname="Manu Sporny" initials="M." surname="Sporny">
<organization>Digital Bazaar</organization>
</author>
<date day="6" month="February" year="2023"/>
<abstract>
<t> This document describes a mechanism for creating, encoding,
and
verifying digital signatures or message authentication codes over
components of an HTTP message. This mechanism supports use cases
where the full HTTP message may not be known to the signer, and where
the message may be transformed (e.g., by intermediaries) before
reaching the verifier. This document also describes a means for
requesting that a signature be applied to a subsequent HTTP message
in an ongoing HTTP exchange.
</t> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9112.xml"
</abstract> />
</front> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9113.xml"
<seriesInfo name="Internet-Draft" value="draft-ietf-httpbis-message-si />
gnatures-16"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9114.xml"
</reference> />
<reference anchor="TLS">
<front> <!-- [I-D.ietf-httpbis-message-signatures] IESG Evaluation::Revised I-D Needed.
<title>The Transport Layer Security (TLS) Protocol Version 1.3</titl Updated to long version because missing editor roles for Backman and Richer. -->
e> <reference anchor="I-D.ietf-httpbis-message-signatures" target="https://datatrac
<author fullname="E. Rescorla" initials="E." surname="Rescorla"> ker.ietf.org/doc/html/draft-ietf-httpbis-message-signatures-17">
<organization/> <front>
</author> <title>HTTP Message Signatures</title>
<date month="August" year="2018"/> <author initials="A." surname="Backman" fullname="Annabelle Backman" role="edito
<abstract> r">
<t>This document specifies version 1.3 of the Transport Layer Secu <organization>Amazon</organization>
rity (TLS) protocol. TLS allows client/server applications to communicate over </author>
the Internet in a way that is designed to prevent eavesdropping, tampering, and <author initials="J." surname="Richer" fullname="Justin Richer" role="editor">
message forgery.</t> <organization>Bespoke Engineering</organization>
<t>This document updates RFCs 5705 and 6066, and obsoletes RFCs 50 </author>
77, 5246, and 6961. This document also specifies new requirements for TLS 1.2 i <author initials="M." surname="Sporny" fullname="Manu Sporny">
mplementations.</t> <organization>Digital Bazaar</organization>
</abstract> </author>
</front> <date month="May" day="2" year="2023"/>
<seriesInfo name="RFC" value="8446"/> </front>
<seriesInfo name="DOI" value="10.17487/RFC8446"/> <seriesInfo name="Internet-Draft" value="draft-ietf-httpbis-message-signatures-1
</reference> 7"/>
<reference anchor="TLS1.2"> </reference>
<front>
<title>The Transport Layer Security (TLS) Protocol Version 1.2</titl <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8446.xml"
e> />
<author fullname="T. Dierks" initials="T." surname="Dierks"> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.5246.xml"
<organization/> />
</author> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7468.xml"
<author fullname="E. Rescorla" initials="E." surname="Rescorla"> />
<organization/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7541.xml"
</author> />
<date month="August" year="2008"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9204.xml"
<abstract> />
<t>This document specifies Version 1.2 of the Transport Layer Secu <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.6585.xml"
rity (TLS) protocol. The TLS protocol provides communications security over the />
Internet. The protocol allows client/server applications to communicate in a w <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7239.xml"
ay that is designed to prevent eavesdropping, tampering, or message forgery. [S />
TANDARDS-TRACK]</t> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8705.xml"
</abstract> />
</front>
<seriesInfo name="RFC" value="5246"/>
<seriesInfo name="DOI" value="10.17487/RFC5246"/>
</reference>
<reference anchor="RFC7468">
<front>
<title>Textual Encodings of PKIX, PKCS, and CMS Structures</title>
<author fullname="S. Josefsson" initials="S." surname="Josefsson">
<organization/>
</author>
<author fullname="S. Leonard" initials="S." surname="Leonard">
<organization/>
</author>
<date month="April" year="2015"/>
<abstract>
<t>This document describes and discusses the textual encodings of
the Public-Key Infrastructure X.509 (PKIX), Public-Key Cryptography Standards (P
KCS), and Cryptographic Message Syntax (CMS). The textual encodings are well-kn
own, are implemented by several applications and libraries, and are widely deplo
yed. This document articulates the de facto rules by which existing implementat
ions operate and defines them so that future implementations can interoperate.</
t>
</abstract>
</front>
<seriesInfo name="RFC" value="7468"/>
<seriesInfo name="DOI" value="10.17487/RFC7468"/>
</reference>
<reference anchor="HPACK">
<front>
<title>HPACK: Header Compression for HTTP/2</title>
<author fullname="R. Peon" initials="R." surname="Peon">
<organization/>
</author>
<author fullname="H. Ruellan" initials="H." surname="Ruellan">
<organization/>
</author>
<date month="May" year="2015"/>
<abstract>
<t>This specification defines HPACK, a compression format for effi
ciently representing HTTP header fields, to be used in HTTP/2.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="7541"/>
<seriesInfo name="DOI" value="10.17487/RFC7541"/>
</reference>
<reference anchor="QPACK">
<front>
<title>QPACK: Field Compression for HTTP/3</title>
<author fullname="C. Krasic" initials="C." surname="Krasic">
<organization/>
</author>
<author fullname="M. Bishop" initials="M." surname="Bishop">
<organization/>
</author>
<author fullname="A. Frindell" initials="A." role="editor" surname="
Frindell">
<organization/>
</author>
<date month="June" year="2022"/>
<abstract>
<t>This specification defines QPACK: a compression format for effi
ciently representing HTTP fields that is to be used in HTTP/3. This is a variati
on of HPACK compression that seeks to reduce head-of-line blocking.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="9204"/>
<seriesInfo name="DOI" value="10.17487/RFC9204"/>
</reference>
<reference anchor="RFC6585">
<front>
<title>Additional HTTP Status Codes</title>
<author fullname="M. Nottingham" initials="M." surname="Nottingham">
<organization/>
</author>
<author fullname="R. Fielding" initials="R." surname="Fielding">
<organization/>
</author>
<date month="April" year="2012"/>
<abstract>
<t>This document specifies additional HyperText Transfer Protocol
(HTTP) status codes for a variety of common situations. [STANDARDS-TRACK]</t>
</abstract>
</front>
<seriesInfo name="RFC" value="6585"/>
<seriesInfo name="DOI" value="10.17487/RFC6585"/>
</reference>
<reference anchor="RFC7239">
<front>
<title>Forwarded HTTP Extension</title>
<author fullname="A. Petersson" initials="A." surname="Petersson">
<organization/>
</author>
<author fullname="M. Nilsson" initials="M." surname="Nilsson">
<organization/>
</author>
<date month="June" year="2014"/>
<abstract>
<t>This document defines an HTTP extension header field that allow
s proxy components to disclose information lost in the proxying process, for exa
mple, the originating IP address of a request or IP address of the proxy on the
user-agent-facing interface. In a path of proxying components, this makes it po
ssible to arrange it so that each subsequent component will have access to, for
example, all IP addresses used in the chain of proxied HTTP requests.</t>
<t>This document also specifies guidelines for a proxy administrat
or to anonymize the origin of a request.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="7239"/>
<seriesInfo name="DOI" value="10.17487/RFC7239"/>
</reference>
<reference anchor="RFC8705">
<front>
<title>OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bo
und Access Tokens</title>
<author fullname="B. Campbell" initials="B." surname="Campbell">
<organization/>
</author>
<author fullname="J. Bradley" initials="J." surname="Bradley">
<organization/>
</author>
<author fullname="N. Sakimura" initials="N." surname="Sakimura">
<organization/>
</author>
<author fullname="T. Lodderstedt" initials="T." surname="Lodderstedt
">
<organization/>
</author>
<date month="February" year="2020"/>
<abstract>
<t>This document describes OAuth client authentication and certifi
cate-bound access and refresh tokens using mutual Transport Layer Security (TLS)
authentication with X.509 certificates. OAuth clients are provided a mechanism
for authentication to the authorization server using mutual TLS, based on eithe
r self-signed certificates or public key infrastructure (PKI). OAuth authorizati
on servers are provided a mechanism for binding access tokens to a client's mutu
al-TLS certificate, and OAuth protected resources are provided a method for ensu
ring that such an access token presented to it was issued to the client presenti
ng the token.</t>
</abstract>
</front>
<seriesInfo name="RFC" value="8705"/>
<seriesInfo name="DOI" value="10.17487/RFC8705"/>
</reference>
</references> </references>
</references> </references>
<section anchor="example"> <section anchor="example">
<name>Example</name> <name>Example</name> <t>In a hypothetical example where a TLS client
<t>In a hypothetical example where a TLS client presents the client and would present the client and intermediate certificate from <xref
intermediate certificate from <xref target="example-chain"/> when establishing a target="example-chain"/> when establishing a mutually authenticated TLS
mutually authenticated TLS connection with the TTRP, the proxy would send the connection with the TTRP, the proxy would send the Client-Cert
<tt>Client-Cert</tt> field shown in <xref target="example-header"/> to the backe field shown in <xref target="example-header"/> to the backend. Note that
nd. Note that line line breaks and extra spaces have been added to the field value in Figures
breaks and extra spaces have been added to the field value in <xref target="exam <xref
ple-header"/> target="example-header" format="counter"/> and <xref target="example-chain
and <xref target="example-chain-header"/> -header" format="counter"/> for
for display and formatting purposes only.</t> display and formatting purposes only.</t>
<figure anchor="example-chain"> <figure anchor="example-chain">
<name>Certificate Chain (with client certificate first)</name> <name>Certificate Chain (with Client Certificate First)</name>
<artwork><![CDATA[ <sourcecode><![CDATA[
-----BEGIN CERTIFICATE----- -----BEGIN CERTIFICATE-----
MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJMZXQncyBB MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJMZXQncyBB
dXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0yMDAx dXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0yMDAx
MTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI MTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZI
zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p zj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p
5Be5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIw 5Be5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIw
ADAfBgNVHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMC ADAfBgNVHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMC
BsAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1w BsAwEwYDVR0lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1w
bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMje bGUuY29tMAoGCCqGSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMje
SkC3dFCOOB8TAiEAx/kHSB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk= SkC3dFCOOB8TAiEAx/kHSB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk=
skipping to change at line 745 skipping to change at line 528
IEF1dGhlbnRpY2F0ZSBSb290IEF1dGhvcml0eTAeFw0yMDAxMTQyMTI1NDVaFw00 IEF1dGhlbnRpY2F0ZSBSb290IEF1dGhvcml0eTAeFw0yMDAxMTQyMTI1NDVaFw00
MDAxMDkyMTI1NDVaMFYxCzAJBgNVBAYTAlVTMRswGQYDVQQKDBJMZXQncyBBdXRo MDAxMDkyMTI1NDVaMFYxCzAJBgNVBAYTAlVTMRswGQYDVQQKDBJMZXQncyBBdXRo
ZW50aWNhdGUxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRpY2F0ZSBSb290IEF1dGhv ZW50aWNhdGUxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRpY2F0ZSBSb290IEF1dGhv
cml0eTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFoaHU+Z5bPKmGzlYXtCf+E6 cml0eTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABFoaHU+Z5bPKmGzlYXtCf+E6
HYj62fORaHDOrt+yyh3H/rTcs7ynFfGn+gyFsrSP3Ez88rajv+U2NfD0o0uZ4Pmj HYj62fORaHDOrt+yyh3H/rTcs7ynFfGn+gyFsrSP3Ez88rajv+U2NfD0o0uZ4Pmj
YzBhMB0GA1UdDgQWBBTEA2Q6eecKu9g9yb5glbkhhVINGDAfBgNVHSMEGDAWgBTE YzBhMB0GA1UdDgQWBBTEA2Q6eecKu9g9yb5glbkhhVINGDAfBgNVHSMEGDAWgBTE
A2Q6eecKu9g9yb5glbkhhVINGDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE A2Q6eecKu9g9yb5glbkhhVINGDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQE
AwIBhjAKBggqhkjOPQQDAgNIADBFAiEAmAeg1ycKHriqHnaD4M/UDBpQRpkmdcRF AwIBhjAKBggqhkjOPQQDAgNIADBFAiEAmAeg1ycKHriqHnaD4M/UDBpQRpkmdcRF
YGMg1Qyrkx4CIB4ivz3wQcQkGhcsUZ1SOImd/lq1Q0FLf09rGfLQPWDc YGMg1Qyrkx4CIB4ivz3wQcQkGhcsUZ1SOImd/lq1Q0FLf09rGfLQPWDc
-----END CERTIFICATE----- -----END CERTIFICATE-----
]]></artwork> ]]></sourcecode>
</figure> </figure>
<figure anchor="example-header"> <figure anchor="example-header">
<name>Header Field in HTTP Request to Origin Server</name> <name>Header Field in HTTP Request to Origin Server</name>
<artwork><![CDATA[ <sourcecode><![CDATA[
Client-Cert: :MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJ Client-Cert: :MIIBqDCCAU6gAwIBAgIBBzAKBggqhkjOPQQDAjA6MRswGQYDVQQKDBJ
MZXQncyBBdXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0 MZXQncyBBdXRoZW50aWNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTAeFw0
yMDAxMTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZ yMDAxMTQyMjU1MzNaFw0yMTAxMjMyMjU1MzNaMA0xCzAJBgNVBAMMAkJDMFkwEwYHKoZ
Izj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p5Be Izj0CAQYIKoZIzj0DAQcDQgAE8YnXXfaUgmnMtOXU/IncWalRhebrXmckC8vdgJ1p5Be
5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIwADAfBgN 5F/3YC8OthxM4+k1M6aEAEFcGzkJiNy6J84y7uzo9M6NyMHAwCQYDVR0TBAIwADAfBgN
VHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMCBsAwEwYDVR0 VHSMEGDAWgBRm3WjLa38lbEYCuiCPct0ZaSED2DAOBgNVHQ8BAf8EBAMCBsAwEwYDVR0
lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1wbGUuY29tMAoGCCq lBAwwCgYIKwYBBQUHAwIwHQYDVR0RAQH/BBMwEYEPYmRjQGV4YW1wbGUuY29tMAoGCCq
GSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMjeSkC3dFCOOB8TAiEAx/k GSM49BAMCA0gAMEUCIBHda/r1vaL6G3VliL4/Di6YK0Q6bMjeSkC3dFCOOB8TAiEAx/k
HSB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk=: HSB4urmiZ0NX5r5XarmPk0wmuydBVoU4hBVZ1yhk=:
]]></artwork> ]]></sourcecode>
</figure> </figure>
<t>If the proxy were configured to also include the certificate chain, it would <t>If the proxy were configured to also include the certificate chain, it would
also include the <tt>Client-Cert-Chain</tt> header field. Note that while also include the Client-Cert-Chain header field. Note that while
the following example does illustrate the TTRP inserting the root certificate, the following example does illustrate the TTRP inserting the root certificate,
many deployments will opt to omit the trust anchor.</t> many deployments will opt to omit the trust anchor.</t>
<figure anchor="example-chain-header"> <figure anchor="example-chain-header">
<name>Certificate Chain in HTTP Request to Origin Server</name> <name>Certificate Chain in HTTP Request to Origin Server</name>
<artwork><![CDATA[ <sourcecode><![CDATA[
Client-Cert-Chain: :MIIB5jCCAYugAwIBAgIBFjAKBggqhkjOPQQDAjBWMQsw Client-Cert-Chain: :MIIB5jCCAYugAwIBAgIBFjAKBggqhkjOPQQDAjBWMQsw
CQYDVQQGEwJVUzEbMBkGA1UECgwSTGV0J3MgQXV0aGVudGljYXRlMSowKAYDVQQ CQYDVQQGEwJVUzEbMBkGA1UECgwSTGV0J3MgQXV0aGVudGljYXRlMSowKAYDVQQ
DDCFMZXQncyBBdXRoZW50aWNhdGUgUm9vdCBBdXRob3JpdHkwHhcNMjAwMTE0Mj DDCFMZXQncyBBdXRoZW50aWNhdGUgUm9vdCBBdXRob3JpdHkwHhcNMjAwMTE0Mj
EzMjMwWhcNMzAwMTExMjEzMjMwWjA6MRswGQYDVQQKDBJMZXQncyBBdXRoZW50a EzMjMwWhcNMzAwMTExMjEzMjMwWjA6MRswGQYDVQQKDBJMZXQncyBBdXRoZW50a
WNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTBZMBMGByqGSM49AgEG WNhdGUxGzAZBgNVBAMMEkxBIEludGVybWVkaWF0ZSBDQTBZMBMGByqGSM49AgEG
CCqGSM49AwEHA0IABJf+aA54RC5pyLAR5yfXVYmNpgd+CGUTDp2KOGhc0gK91zx CCqGSM49AwEHA0IABJf+aA54RC5pyLAR5yfXVYmNpgd+CGUTDp2KOGhc0gK91zx
hHesEYkdXkpS2UN8Kati+yHtWCV3kkhCngGyv7RqjZjBkMB0GA1UdDgQWBBRm3W hHesEYkdXkpS2UN8Kati+yHtWCV3kkhCngGyv7RqjZjBkMB0GA1UdDgQWBBRm3W
jLa38lbEYCuiCPct0ZaSED2DAfBgNVHSMEGDAWgBTEA2Q6eecKu9g9yb5glbkhh jLa38lbEYCuiCPct0ZaSED2DAfBgNVHSMEGDAWgBTEA2Q6eecKu9g9yb5glbkhh
VINGDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAKBggqhkjO VINGDASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAKBggqhkjO
PQQDAgNJADBGAiEA5pLvaFwRRkxomIAtDIwg9D7gC1xzxBl4r28EzmSO1pcCIQC PQQDAgNJADBGAiEA5pLvaFwRRkxomIAtDIwg9D7gC1xzxBl4r28EzmSO1pcCIQC
skipping to change at line 790 skipping to change at line 576
QQKDBJMZXQncyBBdXRoZW50aWNhdGUxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRp QQKDBJMZXQncyBBdXRoZW50aWNhdGUxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRp
Y2F0ZSBSb290IEF1dGhvcml0eTAeFw0yMDAxMTQyMTI1NDVaFw00MDAxMDkyMTI Y2F0ZSBSb290IEF1dGhvcml0eTAeFw0yMDAxMTQyMTI1NDVaFw00MDAxMDkyMTI
1NDVaMFYxCzAJBgNVBAYTAlVTMRswGQYDVQQKDBJMZXQncyBBdXRoZW50aWNhdG 1NDVaMFYxCzAJBgNVBAYTAlVTMRswGQYDVQQKDBJMZXQncyBBdXRoZW50aWNhdG
UxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRpY2F0ZSBSb290IEF1dGhvcml0eTBZM UxKjAoBgNVBAMMIUxldCdzIEF1dGhlbnRpY2F0ZSBSb290IEF1dGhvcml0eTBZM
BMGByqGSM49AgEGCCqGSM49AwEHA0IABFoaHU+Z5bPKmGzlYXtCf+E6HYj62fOR BMGByqGSM49AgEGCCqGSM49AwEHA0IABFoaHU+Z5bPKmGzlYXtCf+E6HYj62fOR
aHDOrt+yyh3H/rTcs7ynFfGn+gyFsrSP3Ez88rajv+U2NfD0o0uZ4PmjYzBhMB0 aHDOrt+yyh3H/rTcs7ynFfGn+gyFsrSP3Ez88rajv+U2NfD0o0uZ4PmjYzBhMB0
GA1UdDgQWBBTEA2Q6eecKu9g9yb5glbkhhVINGDAfBgNVHSMEGDAWgBTEA2Q6ee GA1UdDgQWBBTEA2Q6eecKu9g9yb5glbkhhVINGDAfBgNVHSMEGDAWgBTEA2Q6ee
cKu9g9yb5glbkhhVINGDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBh cKu9g9yb5glbkhhVINGDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBh
jAKBggqhkjOPQQDAgNIADBFAiEAmAeg1ycKHriqHnaD4M/UDBpQRpkmdcRFYGMg jAKBggqhkjOPQQDAgNIADBFAiEAmAeg1ycKHriqHnaD4M/UDBpQRpkmdcRFYGMg
1Qyrkx4CIB4ivz3wQcQkGhcsUZ1SOImd/lq1Q0FLf09rGfLQPWDc: 1Qyrkx4CIB4ivz3wQcQkGhcsUZ1SOImd/lq1Q0FLf09rGfLQPWDc:
]]></artwork> ]]></sourcecode>
</figure> </figure>
</section> </section>
<section anchor="select-design-considerations"> <section anchor="select-design-considerations">
<name>Select Design Considerations</name> <name>Select Design Considerations</name>
<section anchor="field-injection"> <section anchor="field-injection">
<name>Field Injection</name> <name>Field Injection</name>
<t>This document requires that the TTRP sanitize the fields of the incom ing request by <t>This document requires that the TTRP sanitize the fields of the incom ing request by
removing or overwriting any existing instances of the <tt>Client-Cert</tt> removing or overwriting any existing instances of the Client-Cert
and <tt>Client-Cert-Chain</tt> header fields and Client-Cert-Chain header fields
before dispatching that request to the backend application. Otherwise, a client before dispatching that request to the backend application. Otherwise, a client
could inject its own values that would appear to the backend to could inject its own values that would appear to the backend to
have come from the TTRP. Although numerous other methods of detecting/preventing have come from the TTRP. Although numerous other methods of detecting and preven ting
field injection are possible, such as the use of a unique secret value as part field injection are possible, such as the use of a unique secret value as part
of the field name or value or the application of a signature, HMAC, or AEAD, of the field name or value or the application of a signature, HMAC, or AEAD,
there is no common general mechanism. The potential problem of there is no common general mechanism. The potential problem of
client field injection is not at all unique to the functionality of this documen client field injection is not at all unique to the functionality of this documen
t, t;
and it would therefore be inappropriate for this document to define a one-off therefore, it would be inappropriate for this document to define a one-off
solution. In the absence of a generic common solution existing currently, solution. Since a generic common solution does not currently exist,
stripping/sanitizing the fields is the de facto means of protecting against stripping and sanitizing the fields is the de facto means of protecting against
field injection in practice. Sanitizing the fields is sufficient when field injection in practice. Sanitizing the fields is sufficient when
properly implemented and is a normative requirement of <xref target="sec"/>.</t> properly implemented and is a normative requirement of <xref target="sec"/>.</t>
</section> </section>
<section anchor="the-forwarded-http-extension"> <section anchor="the-forwarded-http-extension">
<name>The Forwarded HTTP Extension</name> <name>The Forwarded HTTP Extension</name>
<t>The <tt>Forwarded</tt> HTTP header field defined in <xref target="RFC <t>The Forwarded HTTP header field defined in <xref
7239"/> allows proxy target="RFC7239"/> allows proxy components to disclose information
components to disclose information lost in the proxying process. The TLS client lost in the proxying process. The TLS client certificate information
certificate information of concern to this document could have been communicated of concern to this document could have been communicated with an
with an extension parameter to the <tt>Forwarded</tt> field; however, doing so extension parameter to the Forwarded field; however, doing so
would have had some disadvantages that this document endeavored to avoid. The would have had some disadvantages that this document endeavored to
<tt>Forwarded</tt> field syntax allows for information about a full chain of pro avoid. The Forwarded field syntax allows for information
xied about a full chain of proxied HTTP requests, whereas the
HTTP requests, whereas the <tt>Client-Cert</tt> and <tt>Client-Cert-Chain</tt> Client-Cert and Client-Cert-Chain header fields of
header fields of this document are concerned this document are concerned only with conveying information about the
only with conveying information about the certificate presented by the certificate presented by the originating client on the TLS connection
originating client on the TLS connection to the TTRP (which appears as the to the TTRP (which appears as the server from that client's
server from that client's perspective) to backend applications. The multi-hop perspective) to backend applications. The multi-hop syntax of the
syntax of the <tt>Forwarded</tt> field is expressive but also more complicated, Forwarded field is expressive but also more complicated,
which which would make processing it more cumbersome and, more importantly,
would make processing it more cumbersome, and more importantly, make properly would make properly sanitizing its content, as required by <xref
sanitizing its content as required by <xref target="sec"/> to prevent field inje target="sec"/> to prevent field injection, considerably more difficult
ction and error-prone. Thus, this document opted for a flatter and more
considerably more difficult and error-prone. Thus, this document opted for a straightforward structure.</t>
flatter and more straightforward structure.</t>
</section> </section>
<section anchor="the-whole-certificate-and-certificate-chain"> <section anchor="the-whole-certificate-and-certificate-chain">
<name>The Whole Certificate and Certificate Chain</name> <name>The Whole Certificate and Certificate Chain</name>
<t>Different applications will have varying requirements about what info <t>Different applications will have varying requirements about what
rmation information from the client certificate is needed, such as the subject
from the client certificate is needed, such as the subject and/or issuer and/or issuer distinguished name, subject alternative name(s), serial
distinguished name, subject alternative name(s), serial number, subject public number, subject public key info, fingerprint, etc. Furthermore, some
key info, fingerprint, etc. Furthermore, some applications, such as applications, such as that described in <xref target="RFC8705"/>, make
<xref target="RFC8705"/>, make use of the entire certificate. In order to accomm use of the entire certificate. In order to accommodate the latter and
odate the ensure wide applicability by not trying to cherry-pick particular
latter and ensure wide applicability by not trying to cherry-pick particular certificate information, this document opted to pass the full, encoded
certificate information, this document opted to pass the full, encoded certifica certificate as the value of the Client-Cert field.</t>
te <t>The validation of the client certificate and chain of the mutually
as the value of the <tt>Client-Cert</tt> field.</t> authenticated TLS connection is typically performed by the TTRP during
<t>The validation of the client certificate and chain of the mutually au the handshake. With the responsibility of certificate validation
thenticated falling on the TTRP, the end-entity certificate is oftentimes
TLS connection is typically performed by the TTRP during the handshake. With th sufficient for the needs of the origin server. The separate
e Client-Cert-Chain field can convey the certificate chain for
responsibility of certificate validation falling on the TTRP, the origin server deployments that require this additional
end-entity certificate is oftentimes sufficient for the needs of the origin serv information.</t>
er.
The separate <tt>Client-Cert-Chain</tt> field can convey the certificate chain f
or
origin server deployments that require this additional information.</t>
</section> </section>
</section> </section>
<section anchor="acknowledgements"> <section anchor="acknowledgements" toc="default" numbered="false">
<name>Acknowledgements</name> <name>Acknowledgements</name>
<t>The authors would like to thank the following individuals who've contri <t>The authors would like to thank the following individuals who have cont
buted in various ways ranging from just being generally supportive of bringing f ributed to this document in various ways, ranging from just being generally supp
orth the document to providing specific feedback or content:</t> ortive of bringing forth the document to providing specific feedback or content:
<ul spacing="normal"> </t>
<li>Evan Anderson</li>
<li>Annabelle Backman</li>
<li>Alan Frindell</li>
<li>Rory Hewitt</li>
<li>Fredrik Jeansson</li>
<li>Benjamin Kaduk</li>
<li>Torsten Lodderstedt</li>
<li>Kathleen Moriarty</li>
<li>Mark Nottingham</li>
<li>Erik Nygren</li>
<li>Mike Ounsworth</li>
<li>Lucas Pardue</li>
<li>Matt Peterson</li>
<li>Eric Rescorla</li>
<li>Justin Richer</li>
<li>Michael Richardson</li>
<li>Joe Salowey</li>
<li>Rich Salz</li>
<li>Mohit Sethi</li>
<li>Rifaat Shekh-Yusef</li>
<li>Travis Spencer</li>
<li>Nick Sullivan</li>
<li>Willy Tarreau</li>
<li>Martin Thomson</li>
<li>Peter Wu</li>
<li>Hans Zandbelt</li>
</ul>
</section>
<section anchor="document-history">
<name>Document History</name>
<ul empty="true">
<li>
<t>To be removed by the RFC Editor before publication as an RFC</t>
</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-06</t>
<ul spacing="normal">
<li>Updates from IESG review</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-05</t>
<ul spacing="normal">
<li>Correct a couple references</li>
<li>Updates from Genart Last Call review</li>
<li>Incorporate AD review feedback</li>
<li>Editorial updates</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-04</t>
<ul spacing="normal">
<li>Updates, fixes, and clarifications from WGLC feedback</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-03</t>
<ul spacing="normal">
<li>State that the certificate chain is in the same order as it appears
in TLS rather than copying the language from TLS</li>
<li>Update references for HTTP Semantics, HTTP/3, and QPACK to point to
the now RFCs 9110/9114/9204</li>
<li>HTTP Semantics now a normative ref</li>
<li>Mention that origin server access control decisions can be
conveyed by selecting response content or with a 403</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-02</t>
<ul spacing="normal">
<li>Add a note about cert retention on TLS session resumption</li>
<li>Say to use only the last one in the case of multiple post-handshake
client cert authentications</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-01</t>
<ul spacing="normal">
<li>Use RFC 8941 Structured Field Values for HTTP</li>
<li>Introduce a separate header that can convey the certificate chain</l
i>
<li>Add considerations on header compression and size</li>
<li>Describe interaction with caching</li>
<li>Fill out IANA Considerations with HTTP field name registrations</li>
<li>Discuss renegotiation</li>
</ul>
<t>draft-ietf-httpbis-client-cert-field-00</t>
<ul spacing="normal">
<li>Initial WG revision</li>
<li>Mike Bishop added as co-editor</li>
</ul>
<t>draft-bdc-something-something-certificate-05</t>
<ul spacing="normal">
<li>Change intended status of the draft to Informational</li>
<li>Editorial updates and (hopefully) clarifications</li>
</ul>
<t>draft-bdc-something-something-certificate-04</t>
<ul spacing="normal">
<li>Update reference from draft-ietf-oauth-mtls to RFC8705</li>
</ul>
<t>draft-bdc-something-something-certificate-03</t>
<ul spacing="normal">
<li>Expanded further discussion notes to capture some of the feedback in
and around the presentation of the draft in SECDISPATCH at IETF 107 and add tho
se who've provided such feedback to the acknowledgements</li>
</ul>
<t>draft-bdc-something-something-certificate-02</t>
<ul spacing="normal">
<li>Editorial tweaks + further discussion notes</li>
</ul>
<t>draft-bdc-something-something-certificate-01</t>
<ul spacing="normal">
<li>Use the RFC v3 Format or die trying</li>
</ul>
<t>draft-bdc-something-something-certificate-00</t>
<ul spacing="normal"> <ul spacing="normal">
<li>Initial draft after a time constrained and rushed <eref target="http
s://datatracker.ietf.org/meeting/106/materials/slides-106-secdispatch-securing-p <li><t><contact fullname="Evan Anderson"/></t></li>
rotocols-between-proxies-and-backend-http-servers-00">secdispatch <li><t><contact fullname="Annabelle Backman"/></t></li>
presentation</eref> <li><t><contact fullname="Alan Frindell"/></t></li>
at IETF 106 in Singapore with the recommendation to write up a draft (at <li><t><contact fullname="Rory Hewitt"/></t></li>
the end of the <li><t><contact fullname="Fredrik Jeansson"/></t></li>
<eref target="https://datatracker.ietf.org/meeting/106/materials/minutes-106-sec <li><t><contact fullname="Benjamin Kaduk"/></t></li>
dispatch">minutes</eref>) <li><t><contact fullname="Torsten Lodderstedt"/></t></li>
and some folks expressing interest despite the rather poor presentation</li> <li><t><contact fullname="Kathleen Moriarty"/></t></li>
<li><t><contact fullname="Mark Nottingham"/></t></li>
<li><t><contact fullname="Erik Nygren"/></t></li>
<li><t><contact fullname="Mike Ounsworth"/></t></li>
<li><t><contact fullname="Lucas Pardue"/></t></li>
<li><t><contact fullname="Matt Peterson"/></t></li>
<li><t><contact fullname="Eric Rescorla"/></t></li>
<li><t><contact fullname="Justin Richer"/></t></li>
<li><t><contact fullname="Michael Richardson"/></t></li>
<li><t><contact fullname="Joe Salowey"/></t></li>
<li><t><contact fullname="Rich Salz"/></t></li>
<li><t><contact fullname="Mohit Sethi"/></t></li>
<li><t><contact fullname="Rifaat Shekh-Yusef"/></t></li>
<li><t><contact fullname="Travis Spencer"/></t></li>
<li><t><contact fullname="Nick Sullivan"/></t></li>
<li><t><contact fullname="Willy Tarreau"/></t></li>
<li><t><contact fullname="Martin Thomson"/></t></li>
<li><t><contact fullname="Peter Wu"/></t></li>
<li><t><contact fullname="Hans Zandbelt"/></t></li>
</ul> </ul>
</section> </section>
</back> </back>
<!-- ##markdown-source:
H4sIAAqYE2QAA6196XrbOJbofzwFJvVjki5LltfEnulFm20lkTfJcZye/iaU
CEm0KFLFxbLsm36W+yz3ye5ZABKkZMdx94+qWFyAg4OzL2ClUhGJl/jqUL5p
+p4KkkpTRYk86ffP5YlyXBXJI0/57hvhDAaRujuUhcfoCeGGw8CZwRhu5IyS
iqeSUWWSJPOBF1eG/PgQHq+McCQRp4OZF8deGPSXc3ip0+4fCddJ4M/HVr3f
/iGG8GMcRstD6QWjUAhvHh3KJErjZLtWO6htCydSzqGsz+e+B8/CSLF0Alde
Ksev9L2ZEoswmo6jMJ0f0lLEVC3hknsoKhIBg38YLolweSMcRQkRJzDK/zp+
GAAsSxWLeOZEyf/+kYaJig9lAKDcqSBVh0JKe3QpE1rJNczqBWN5jPfg6iRE
pOCE8eHmJv67GFfDaLwJ92aO58P6DKoqi/HfFjt4E+450XCSv+d7cRJX+eZm
HW55dyrePE8HsPhNewAcNlLzMH917CWTdFAdhjM9O/1TUfeJCnAD4k3fGSg/
3lzdJX61AhuVqgo9dShXnxJOmkzCCBFSgf8kbBggqlGVTWc2h3d8usjE0Yg8
JyjegBU5gfdAW3gozxF3HRem8JIl3VeMpcFQv/S3OTzi6SdwWcV5u1XZ8OJJ
OLdm7XpTZV+FKYFypg6MbE8xG9Ajf1N36o9UjcK0OlB0PwqROZTrJWEkRBBG
M4D2jkjg8qj54WB365Cec7147jtAsr3+5VWzf3XZblWOOu3PrR4/ebC1VSs9
SbSDFF4cE57cXvPk5lZ1K3tgZ90D29nt3XW3d+Bap9KqFthzpuLYGatK7I0D
J0kjoPPVV3udYyEqlYp0BnESOcNEiP7EiyXwfTpDLnJVPIy8gYpZcGT0JScs
QohYYplMnEQ6vh8upCP7n3siUdHMg3lx40G4qChWch6F90uZhHIYBncK/pqo
NcwqM7zBLOFIOmKWJimMvZRIkkgh+JiL0+BIgRrSozAuDhhG3tgLZKwimBTG
AniAmmbwAEgAMY9gv4eJM/AV8Cm8G1V5/TPPdX0QFL/JTpBEoZvyoI+/2T9/
CFGXI8eLABY9qKvmfrgkVM2dBFYdSICecSsdW4wBVgHEiXOnLDgFYdV6TgMe
y9hL5EBNPBB+ThmDiGyDYNgZxHeOiFiOonCmERtXZX9i3gMInOEQyMLD5Wt8
eQECrRISs0gbTjKcgIDUGxMh04CUMo8DqFE4B35PyqhegFghdMPdO76N8yYA
lXIFzICSm8EpvAhARQokMNCaF8HDuM85lIOlWQkBiI+Ggb8UoCaGE9rGZAIy
eTwh6Ap44rkGznCqcGkqAXEQI0UlSOEo1+GHsDYQB4fLsBNIbOHcgaUTuWoA
FpMQiGaqVpDC6OXlCAQzVvhQPIfdgP1xkD8MjEu9eiJh2qnyCNJLYuWPqqLu
69eYmnD7/DiUaczcoGYIOYwyANwqFVgDIQwrzLAh8FKZa4iWckaEZQFWQWIC
3Dkhw9SI9WwmhlCYaYrkybNVUZKodfzh4cgpvErUEqSzAawZtuXOiUCAeTBx
nA4niLWgAj8Bo6gZkY5QiG0g9AmLJh9Ea7SUmrbgls1IfugAahzfCYYohBAq
D8hqg6CGKzBWTGOBHvABfAA4QzhSo7ofKhAWwRjWDWLjzvFh0g3G36rQskQT
Tu6BhQEmQgIWS5xvFM/Myxs6SBqrEiscweKIwoAbYmELQ2cQpslTUhM3y0Mu
KaBg7A2rsofz0d9i5o0nCcAw9FNXaT4zSACEDj2yHQCRKahFfAcgG28Q4AMQ
RYhIshtg30Ngq1jArMMwnOKuATM4NkgbMqePeI70BqIP0Oi5mWwnTOiBWVQJ
fBIHyBg24xF7tQFsDSIU+QHoZknSxwgos36hsThjQdiBKSPSWQA0PBoTtysS
CTbWcpKlNSFpAcZAdYB6BAraWEPyCE5sabbndk3Y6ygqrVU9UJV1fhcpCQFd
RF7CW2I00MJZskSzJwX6Y1AASXALpGga4+YFYVAhW9iJ3Ex3A9hOFJE+LgD3
FqkSqFiqYBjiFr1DmY67dee5IIOAo6OEaDhSAJrHEog0mpaQgsQL2hNGsbhr
9TRuPTwVh35K4BM7y0GaCFJP4VxFzsDzwTTMRVAA+wSCHTAKDOrCdvjwmItY
AbFLmzcEo3QAaCcJQwsBQw8ehJfhGa1geBTETcjwwz2fSIYxOZyEKDYsGobp
ZmD7yLc+GKBigSskTJJZytosjQESwBX+Dfsw8sZphMpqA3SIByTPiCNVVKBr
dH9A8ABwyt3AASZgUJVpHxBFG6Lcd0AecgHWc2UahItAWtaNIEUNOpLx7cWa
XFCxDYdpFOGKR2lAWsAhzA7DFBYBy49CYFRSY4gLb7R80S6UEBdrBRAPQ1K0
DERmV7I1ZKxLWDO4QgiS4TJElI/Ic2F+kt9aLggjF+J0BD9JDsJII2eIkBF+
eAUsbsEiVVElCVHQlFcBGpZ1zUYJuNzoBcXCBF0wdzfkd8tX/k4axb5SaU4c
L/i+IfV2k0ksnzaJ3/b7l+fvpOMSN4rMvIj14hLLjinaTmzjFKDRxAiCNlUo
BABbASsaeL3CDtZaBYJylp572t62zMyC1WFMGlyaHtrIflxaVZ7Nmc78JYlP
sQZbNtyyALcN5RCfZf4CaSeK6qS8yPw9LWBUgLwRr0Go0OoXsA0iyPce1BOK
tqCRveApnXtN5EuiEaQFMgxur8dYoG1HlQkrANc0LuASEbbegJNv5yFaPh6b
fyjIUO29zD8qTDJ7x1rMYs7innwvELwk7UJT8yZK35t5CQtzEle48QXBnuGz
tH+kEBZg24GsQvJG83X5FA0xesWqk0dEJcBb+01eWjpenoZaaiP+mqgACeSY
RdEUNDPGimL5pnvV67/Z4H/l6Rn9fdm+uOqAc49/907qnz9nfwj9RO/k7Opz
K/8rf7N51u22T1v8MlyVhUviTbd+84btoTdn5/3O2Wn98xtWmLbcIQckRFoh
UQUoQvw4sTACiczHRvP8//3frV35+Pgfl0fN7a2tgx8/9I8PW+934ccCqIBn
I4HPP9H3QK2gHHaLfR8U5BxEpo/2HgibCaoQJFjA7J/+jpj5x6H878FwvrX7
F30BF1y4aHBWuEg4W72y8jIjcc2lNdNk2CxcL2G6CG/9pvDb4N26SATUJ7Ec
At+y36Rjj6wiyuGQ1BjtoxCDHUT21vskQx8fe5pad5C1dCzpxw8BW8taDHyk
Jci3e5oPbAFkn0P5GVQgXWksgVF6qASCIW7G+SQiZwHtjRf6H2A6PCPFMxNF
+85soNrrBFAjNWJ5qN1KchUWSB8DEOJIQVqeCf0MRdB8AlAzfwkostHLLoJZ
jJYH4PEAH3+t7tUOCutj+t7b/lAD+ia0oY4HMQJ2nKKQc2ZOhRG73mjUCROM
QN4nB8VEKwAwMNvHIUhTEjlO2TNmJwHtvnQ21xpGsGdqPVaV6FeQSwo2ZYSu
COplErgAEI75+PhX+OfPSAe7u/tAB3xhq7r9Z1oSXmP0G69vxSuPldYHTXvL
A1dYv7+oCClLh/1gL1Oy8fCtCTwaTzBygZjT7o/MNd4dv4pKYHVAfOXICzAk
4GajA1VyYBLxk0RgdFIYSsKi4EqGV0Da25wdDqrb1S3Eyl91qPPHj3c6KhdO
vIGXjbGD25pULLCLhFQac6c0ZlWegNWHEQ8OuAC5W944E36Ym6sSY0nknL7A
rw/yiC1so47pssiNlI1WdKZBbOMNtAKYo8iuy2neNisGDvkMqz5UVa7ECMHi
cdg4DHU0wSZJ4YxAJsHrQ+XNWaLQBmeyYfRk5JUjTE8ZFGyUpGgzexxCNaQ0
U2CXAYnMYllQVUjVwggVMIpQADy/tWwxmVAXiR7y1Egab+g4mkgDlIU+Otoy
98thYbPUT7y5X7A5OHK4YkTmkQUT6wyDAh5JyLEBj8Ea1qVle4aGxuGERqvv
wA4/v8ZczWtTM+dJtrqE9sxzXCJWvKCK8emVBB6v75wlNLL8ZYo27uNvPFj8
Y01Mn3ICK6pMv7ABT4y8AMFKIyJeQMTjI98F+YXTPT7SqivmYsE/3ijEFP59
MX72djSUdhbBGk5k8aKVtMNq2EEIy+Y9FIeSJljvQrDgGBSWpEMeCGW+22ST
r0ajC3Oxz4Mz9p91cORzDk4hWIP60HNfDuGaeDmZQ20d62GT2eB6xVTlCESJ
zWIyXYQxXWJbUO9Ud6p7BXvonSU02evTKxyAGwCkg1JOoCSQrfalCXmgIdDp
X1W/7h/UqlsHB2juPm8tVAUoaDUaARzaz58pJ7B0rJ4OJ1kfZtGxM5TQ+7vi
LWIPLSYfWEQOQHlg5DmeOxhcRqshJJaBfUTBhMiDh2PYGu114iAg3eYTBxyy
d8RMGMlmf4p2ZgjGJJoPALZHY+HbsDvg3WgHqoh2zIlQ1DhOwggGMWBTfD1R
98hZkhlkw8TWiUDDQBXldb5de7mmfr+7/+HHDxO6ItEMi3Yx6ulEPlBhOJsD
haI+0BZewYD9L+mNZByCNAXHzwOvA+ReMXYTqbkP2BPfK5XK20b7uHP6f8Cc
fyeb7ct+56jTrPfbcOc7j/798DvJO3D5MExlbQIugAK8aJCOwQiJWEAXclaA
5RkT+rNFEZn0BOHZCbRdGSAuSVz9JJ6TR5A38qSMwNRRnHHjOlvjzvF8x8rN
mRCFrfsN74oV+G2PXcc72Ht/MghkmR8vFG5FKUbEUNztXLYYlha5Xsso04nL
dGdCzMivYjWmVY5GkC5G+QhwG6MsT8shfRh3FciNF5c/pfNyaLrrJSB/+yop
pbX1EghY1oeg5m0WMfIMKwByDslmplyvI7HKg/NbMFpMEgIjsCKzVdguJW41
Np+AedS9gyZqrmIZUXwVfk4cXKnUF4zwfBpvK2TPSmgt8ReU+7+PBcAn5wzq
2rCe+CUGeGoltgm1TunyjpOzXVBPW0XlBNTRxvA5CgzNCoJ2krYXw3klwn8R
bev0NwLoMT/GzkxxhljfoBxbQOh9axKhTwjp3eou+FvsZiLI61abUaMO/YDp
jI58mYvR2tYuOEeOQFq7oYoFpkI53ZulDZ8WI9Lke4yK0EMi2NaMVeLwKAyL
8g+pAxAbgirMkuMrC9rILZ1MgydONFaJKJV+xJKzIkBLOkrASNbDU9UZLHU4
CaM1MsdEpV8neQRLHvmc5MHlPi8iMndGrBERUh5hgojBQx0c6TjIPI0wgRST
xuWEL0Wf7xxQA2MVpjFHonzM8GIFGkYbw9x1Ak2ROGi+FaRQydz/ZVm0Dp86
hFt2XbS/EptATJqglo/t9C7KiHn+WkQeD+7KilwSa1MtRDoItAlVIOM+EzKz
3eufFjBpDwTttJXI9dqsAxDEVZxhLQFnOvCw9oSTZCRrsiyiiU1ZhRXh3MS8
hRWry/FSdiPJYkRkmQIcyomRENfC1TGDCs6Y4E7VOTORIYz3I2W4X4i73Hph
tGXmKOWIi0LuryTUcKlr4mUso7RzxKCINTsx52oa4H8gGl0Wg2yv3JUgT4iJ
dWJNFPvCZmsTlUkDoFyfspGlZT2T4RZWeVTJ3Z5hctPUhx0KscXqYX1ghkxk
1xhlz1hHOpujK/00SHolG2uUiWHpqtiuyg6a6hmxYRJam3LGCWX39NkQUgYp
wvASMWCGewpIHKccb6iKnaqsByabTRp4rQUE9POz+WMLVp2F8lHZgaYgu4aJ
wOh9djwovQ//RliQgb7XQAFHEdrh34UTuSb4msnrerA6aCaHnBWwcaifYk6r
zEjdUpmddsC0vtmt1TKdAwx8WapaI3amSoaQgvUrvJp555rJ10QtyxF+lKig
1S2patAWOwEw2AN7GYRDiroHzJUgOUS+k/H6rXwizV7aS3D0MJgWCkP+pY0o
S+IsFNRYm2Gn7C0ukrDwMt6zZnIV6yKFXrC2oQ2C88om37jC2b4AJp8Jw24Y
n3o1vUr5mZXsqhaOVVF/ouRLFuLPaxj7LSAVGHvKU4Sjd7q8Jq8zGmDpn49r
IwJnusuq9Zy4VDtaptWd7J0N4a1UxrCCUDOMxgRYtzYvRqDHHqbDtYNStUIl
ua+tQz4Rxo0xthJFupopazRIMofXd5a6UMwJRGFCGyYKZyC9U6ydCnvB8JIU
XfXRfLqe6KR+Ib5VJCBDLGVD0+QpGKdk+DF6xFtVHVdNGVoJzVmNbyUrbXTf
lZ4lltShJfSOgyFoPEWr00PTVnJV1Pcm3qw0eTRslahQmOk7FYMNVB5N5ooM
TQJ3OF9qouZkbKSDmHwlq6g4U4rkBRWLajQ+GHMWQCApvzjYQVLCol4cv1YV
HfJRkZXQ/UoDisTlSDShqu9W58N3q44rU7Q4VwYM3Se7WieqsTCUWJelJJDL
GH9yBbZjyx497WApksgJYgzHmZtF4qAJy+vRkAE5fP/TdyCsI9YxWSEJ5fp1
qB4FjnI9rKaNLffPdddqx7WlOKXi/ix1xQFOsluWbO9z2Zb4ZZ1blT1vBs5+
hNkCw58GWMEVs6/T5rhzBlxKmLRySxmoGGOpkWb4x99yK/oHuSKFMEgzd6oE
0lNJfK8t2tHKA+vtnDmxFOyrCcPlw2k+OzmvNz+hfUt/oHn7fg+jD7jOC3Pv
wtw72K7tgpuf19WyBtd+2z3s9gxNEJByAYV2Ga3/Gef8Ro5eyTPRlUBY8cQ2
deRl+YYV/fuzwi0uugTDMR2qglOqdMAXrHAUFyRBsXITNFJgkMYFiOCee2Ot
y+zXfPDhUQ6ADRUpJzbMQ4Br3nGXwLreUJKkrpotIyxletgK/OtpC2/hzqFE
zyPUWO2E8QXQSgkZAyOPwyMDFSh8BoxFrCzwF84yzjP1pQgi+vgAgeNvCKA+
SgjjNqGO5ohPYjZHGfCRHrucbzd02YPFoieWd7eYLC/5YARnZJL0hitoIo9U
AyosXaqFIV1UZ05AMItMEe9sybfaVCylGfthKD/jFO9knDhJimaEy06WFRU1
aYP9vQ97aKe30iycp5srCntWJB6OVFMJmKVnMRMEeANbZc6CArcBa661e5z7
K7wT2IbEwQCDEefem6UzgxGcnwjPEpZLkzKw6s9sGIoiMQwKpXV5+5Oged07
fDOjUTO9ZUZYkBilqwsqsrKCnR8/hO7A2NzJL6MIwGIt5BUYEFVbZgVZJYY2
jnVItOhmxUgTuPWxvAO3176qzRliN3stjqZnrJ5ITItQnAX9CjwTzxxsq0B3
0omL22JDSn5FaauZ9NEM62npcZkV4QjRw0JuvFmqN5ZuqG0xJKGfJZ2p/odq
e2BhVXFOMUUOvQ5RScRkTZl43KgQL6XiwpVAa2FEjrsJHxBPNZJoa2KWMFyB
mkkHC7ICE/nWAU7EU6wMDGxwCG22gW9DT1vVSSNqxchpklOJK1iIuYbf01Wk
GA2Vzsv0t1avozyuiPge2IkrU3pi8ArqFwRDGmGceEX5xmr4w04zG+ZaiVdx
EMrYc9SMkvlqpRJZ8PtMVTv8Pebam6wBa6Psc4FyBPFlKhfyeqEsJySonhf5
icavUCLXjr2NdIuU9qFfVDtdCPeVBEuWK3YSrrnlBDT4WeCgbWBDAFc2oQik
gBQ5lzrul5jNd0YjTCaQU7Y+21hy3Sn0FFEMA8g0UfO8C4udmnxTBgoZ2RK/
iQN7IYhw2RpOAxtycCfANKXGJ23Cl5dtGqPQNdOdGBi1I8rH+kdqwORwAWUz
NY/9aoTAlNVo291SHNQxwRFP4NJiKQsF3VcIz1RkFxti7DyVF3D3Cz/5jmN7
rho5YK+VwrnIuoQjLdYHJAaQuXTMoeB/xEimqakWZLTINwB9xQveGFVbaO2o
UgaPm5+sbTLm8q0xBIuL0/Y4OXCsuQiU18RkiOscE3sVhM23WamE7k4N8iew
V3CSV/JQzB57XehFgsqEk+j+SliNg3F2JM5LBJrsVujJit+ZSFTWhZKlQApW
CmjJMwR44WGMwokGXkIFn0YPoi1lAisrpg1WWKO3gAizk+0a58I0QnFKGhuU
IgAh0YSgBUKgxibA8vQ+5nm7NyOQy4CqkdLF5trwDRBbWBNS6P+haAasH/5P
PW8Asbqfc/suNxughgO1Djo+TDHOoGVNZIr0wGqVWUuNugfsYBUY2dRgUoSz
GcsED9MKsSlPdbD2FzMQeh20s6aLjQr8MJ6sM3Q4CEgXzWLGA3uaP7PGPIxA
oiLC+NkYiyESoRwwcVyYem5Eix2Qp565XI5hx5an4gyMQjZmnh9UYShQ02de
8AeiH81yIJcC1nOjLGuRLLT2MIfYjYymrW2mklIHrUAPxFQh0G5Sa2QW2bNa
K7MOR51yWI9W8VN9u0GyS6f9NqxsY0H76T5ChC8P+cAeoDbSzRos1U2d9apo
f6rHqqw+TW+b4Fa3oOztVsXjY31OLX/3sqFLh19wdgL45GMyidGxztOcggrK
TCTTFv/aMMg8uF42FDV2qyhwsmJJZEnuYQZSnXMrAaOS2vkwQ5UVspsHSTvn
NWxrCiVMstqYlSzD8+6ygnjNYgosjIcUQqBOx5V+90ynVcUZG6N2wyzenimV
ZK5GRrexIkcFUGWlIbnwwEgPQQcw1E/rJWORYzOITo7MnGKE7lKNPTy0Qj9x
DsZ2jFPiVd15lOfaAAKKh+mw3puTJUgcKmbpUzgOXgAzIwmHILvf4kzveCph
T7V8k1UCgXQgeHpq5iCdgz37mFUCHQrxJw0pH1Vi0S3c6ZHzfIiWJ7wMN/Ca
5k1d4K3LLA+z/BwSIJDU//y9UIb5D/Hfg+gvz8zGXPJvnpMOzECKw91qa154
/M1UA5Cx4cjJco7CKyHr2XAM55Qc2yY1jR924gEjTblvnqjV9HqpMEE3PeXH
F5BIf+HJIZlIQkawypVADaI1ZkI6JctHayvqmrKrIfIaiWKiqSrzpATWMwhd
tYiMx7qSa0i5JmRAAth183SyHVBaO5+uy15fsEFxCX30i+kCAVeYe251wQhx
PPDgP//5T9ziSoVqMUtlmJWK6HY6jT9azWb9an9cX3Qa9XGn0Xiof2qMx39M
prdn5xcXrfptfb97GS+OL25aXy4uPrUaH7vfvl4Ew2WjIdyvl+G3672ac306
cY+v7o8f6t8a49MvjXq3257eNzptP3WPvywH11+mzvVR7Vuv0bro19XRorbs
tur3otu/WHZvr7a6D6cOXezX77u33exat167bz7UP5pB69OPre7RdNFe3Jx8
Cr91xMNtrVm/uOngD/i7Vb8Yti7G9faHm+Dr15FzNZ4F3eTs69VmJxheO/7l
RA2ir7PhtPnhzh1/3JqLvYbaO9rcuWl+ABl43939fbrV3Xfa9fbR8Phh+tE7
Xe5//LC7fJ8+hAfd/dNl96S+aCIuLmv9Rr2zEPVWfYTgnfS67eNW/XrcuJzt
XN9+dnY++IP2TTP1mufDpPbN6bVb2636GT178aFRH31ow5KaohHXcT04ot+o
LxbNMSxncdNoXFzBXJ3FCc92Wb842Ww0uov2Tfv8ZnZ5e3H8ZffmemshBsdX
6c32QdKth8fN5h/Hve7uAY5cr43r3fZVs9M4cZ3NaOvO+bx/vPPF9z7vbra8
/ZtPtYv9QfdWid60ueMeNc/OGh/6da9dv9+cnvQauym4pN9qp1/3or2vTjQ7
n9YWs3TpNr6EV7uTxpdvW8vJ9M9MYO3T1ip5/Yz09m6B9G7SjPSObsuk17ju
XsSM7ouL4/bi45erh/ag25gei/rWVbs5XvT6x19qH3e644uvX2rO8RcgN//2
5uul3+2Fi091erHVah5lNGtIVmiaHV/NDu7cJt8Y7HycuyfTxclkeNq9rS+6
/Xate9t+AJJcXOO1B7p2j9cEXXyGO37GHGI9dzS+dRvd48aS97E+bmd7CmRy
Uq916o2Po9+d+t6uuGzuzZef65d7y9HXLzez0/nY/b15fNVvzbc/nR1PhrXx
p4Oth/vJiYrbN1P363Te2746/fAJ9MTvy5PkWjS/7Eynk2YwPl7evb/84/bb
bWPabdSOAblua3xx3XielkeiSPj9dn37Yl+p4af0YHywHOyN/cF0MvnSOYX7
PXr2skuE32zVj5GeBayv3q3v8oyLdmNzcdFGepiUaWF8+rHeahwjee7NP9+B
tLi8nN6HYtapJ63OYnzQej9ubt0/3Df83Wj7Q/th1jvbmg+bnYvmx6veZN77
enZw0upcdK/GJ/sHo9NWu3vytbVzKS6/7o3P30/TdPvTcXf853+BoJsNJGhn
aQj6Y/1Tr7b0/viU+JOwzJzdoxtLst30wZb80n8pKX26rYeGlDpX977bdB+A
nI623OOJPwgu5zfbRE69wfZBTV+/G878mrKEL8nefmfrtPUFZW9N0MXWNLtY
BvFnEIqfgfgzCAWD+AIOOAqdk6vfv+0Nzj/Njh/8m69Jc/R7e1+c3Nzub4/O
Lp2T1lmU/L5cTnZONqP+MH6/DI5Gx8Hv4+VRHPXOd9oPHz5Ezu3d71fbp6NW
Layl33bPZ7fi5qExKXLAs0Q9KjOAeObhc5sDGn1QHMABZeIXT1B/B6j/CKl/
VlfjreXw00nk/XESOK3d7uZVqzG/uJxPZ+7w8kjcABlvXSyj6f0uiP5d7+5h
Z3ExvJiCQIivvm31zjozd9P/Y+uidvR5VDuIjkefL86vW8NnCB8NicdD+VvB
JJF0KuWf39itrBxBf/tEyBpMnyhO3r35waaJ3bIlD19pjAj5YoH7jDUiZM4S
rzdHhOz8q/YImCNC/ksGibZHhHy1RWIZJEK+yiQpWSRC/rJNssYkEfLFRsnh
CsWaFCqTbKE6wFR1X+bFXmccGumRd4zkqjPQ2ptQ0WqqEjNCVln9Sk8Et02h
HyJWHv55jUXucdBxOqLkE2unDOOF0vP9lLxplccEdIjG1LCU6vU3xAyDprb3
T0GncE7IoMwSZX2LhfYlFtadkMzILzXthFxn3P2CbSfkWuvu5cadkOvNuxdb
d0L+krhZVW6AgycMvBfad0I+aeG9zMAT8mkT70UWHgibp228l5h4Qj5n5L3A
xhPyWSuvbOQdbhCdWhYbyO5fttkKBpGQrzDabItIyNdYbZbRJuSrzLYcRiFf
Z7dlZpuQrzTcjN0m5GstN224gap5renGzwr5etuNqBqY6fXGG9pusI2vsN5W
VZ4dN3raVnuJ9uPsP1WvtqhIdF1Ul5VpxySvymcVrB6JQpqpkP4zsf/RE8lA
PC32NUm/VyQghM48FmvPnazk9ZnGRju5mB0RIvShfIQeSopjuFGnFFmxcyEQ
N/eVRk9CQcHEIZbMFML9VZmfdQqIjjCfx6mmmYLrjE2smaNk46bONGJepZxs
tLN/G1bNgNUalHI3U6yGkUrykjhMqYlCFRgV3oam5tdUChWTKo7MkjIb8qRb
b1JJar1db9H5tpGu4DOnY3JRl5+fUKIPRDYHqaFtBpDPMJejPY/yCnVFIFd4
mcWsS7OvnHKoz5o1m5SYCgs+4csuh+eyqNIJTJxrgBWHgaqEo5Ew52PSWaaE
m0FsOl8cXqo3NCvPDtPMCJzbKxJ/uSHwzB7Ke25qTjJGnmmI4S0EQ3PkDLE5
kI5MgGlMkQkyj86jruArP5OlKntPDW8dAYCRe8E5YDzSxRRImQNzsXgyO53d
TikhPI+PWEX0Q5eMwQy6MhpeJvnUNgeW6w7P7Pb31aZ5q81bl9u9397Bw9Wo
dC3WPczWAaO4R1489MO4WFwGF7L2eXqJT7aktjymvzz/IZ6qUMPCuBA2Nwqy
Izwz4mCpkCcK8vytcoXJRuZntQOnAWcl+XFeNhpo6f+VFxa5IR23GYpFPsnE
cfkkWKw7M42kmUwungviKucuNP7NXei5fK7vypTZGWiMXDq/eOXYXAc4DA+q
M11nXO/uFtrzKOWtsCb45RVBopQ2Lh9Pqg9uRezDbHyKHh/Ngc0urC3WHvFb
OJGl1IOz5oTDMD9jYf0ph/KtPkKUBLw+S1yZpkKr03RNOds7KnxY1TTY5IhE
SJXjFfx8gt4Ko/dWtsqjUhCq5UaSw41BZxTLzanK22fS07UHmnIodWw1o2LV
IL2Qnce7oasuIpUXvGBC3LxJAkFYEgoVoNVQpGUBIVgLgmfqYsTQWB8DTGyz
mkYhhAVZlIXDKs0KzBvQeaFpXD4XFjxbfSyPI0Y+HWeerwCdZ8zZ66Ij/J3S
keW5bLqehP7KGW5yxbgSogVwqYhWaX9CgNxrYkgs7DA2TpZgZzJccOXgmgOR
1rdr8lHaRdUdpwMyOAC8TeRLPPI7woY6pN2Uj4JDZb2RP5mXNNCdt/G7DSwT
QBXLBSr5s3P6wAl+uYXg3MCK+jEed+lhR7BKhlV5xAdPzbgcESWPjYj8FBsW
0x/e1/awJ5joJs1LK1HFRwWmtE4B54oI1JWuDnoIa0upQAm7hNy851wffbwk
cyDhDcBmcAA0Wlbm3nDKZUJAUE70lFxfT1NItY4+oAAl3kZ2nEShZDNe0y+0
mpTWRUqrR0etO3PGnF9mnlmfMherDc/5lxKATXF5eU0bd1ysOX8QBM+16QDX
HU76aLdyHbgF/MjhpoUwb7XhQ4SfOIMC615GZN7NVMHOMLXnXBSm11s6EAwR
FytUmMn6AJvu5eFSv+wQgJUDvLAVrliZvFIlo3mX6cGq3LeIhQqo60M8x8JX
7pj5nHeXe9ZjbVrS0aBcnRNMS6UveX0qfcLiP++4WzDyQI6zsYM9P+gBUAdL
5ARjOhwcxcZtStWU+Ftb0ljan85RWCOrAxIHuM30AtX2kNloGbHzrLI+Kz8b
Af5RLUmuWMetOhSiIttgWMg61jTHILYq8GeAXycCkYmtuTOHrvnwzFGE5477
Pvy+DKOlPFGgnBP4dQTKIPKm8iOaqzxIQwW3DviD8pPjplO40AesYcP259DF
mQAF+OYnJ5n4aEp1YdeAiZdwretEUwyhotCbODOEEAc/XY5BNON9RPpZGsQL
XDlc+JwOgUXPQfqnit5PEnmOdheD0kbr/FLFwzDyHfj9MUV5Ki89lCA0HtCO
8ukCjMEvfQwVGNF4jDmChLfw5wM+Hk6wERH8NY/ujBwgqt5ETSeVGxCCI1xr
5NwBcfXm6CXgFKcopHogYLw7Que1hxvad8AxcFJeMoLUn4Qznp7Al9d47wRd
gG/AyrAnCTn3LbPPJx72hC4F9qz/BTBs98lrmQBiWrbpW0umOpfVgLag6PgQ
eIaGeMnHxiq1fXr2T/JqzmdAEMF22r1jPIrIU4tfGGpPD9XEs2Op2RYs7Dn1
V5AeBhNmzVzHKgB0yc944mMTfUM9Lz3ZAfkd4YmwIBLqLX0rI31+hvGBKjLl
cX8B5N3i6lGJ3uM/JNBB/+QnSzCw18efm/n0L59nR8/TS7LzfdZLPC8rrovZ
jXe588JLMuNVH2tkN8ANw/nSqAlg7XGKtZIEMLZMWCu0tiL7ME1efae7p3Z4
/dw6Sef+eHlfPQhRpLBYYpHeJnZSbWJHJU9SKuYL6ENWttc54ue6KtDnlOIZ
KQUB/9TXVEyjPH58S76wWz5rj8fG+F/YrW29W3XXJfhRw5NViA9ha5QGPwz0
Oc3cX5W3EenNdujAzNQ+9ZQONsXqV73LfCaqdeRq6dBTy9goHYD6K2S+Zcg8
ZhGCp3MBLWrT2tXhwy8cEDN0YTiQv9xFzTxGpec9kclPlXiOymGxdSk/J85u
ceUvZjwofq1lPm1BdYyOVWmo+8L5sSPKmMEGral65ceJMq34WFQoe+W5vHiY
xnHx5OVfQHJNGIxRWxjICpJXcUYP1qf2dFGig4ReMR/Py2YauMMKHbWMK7T+
snBrSVsglrHKu5x0U6lp5sUBkQo7uT3k+E8ITkL+WwBPofW8fFcSgb8KYVG4
5qKHJZOF1BApuzJLfAoGaVfkV2czIrZ9P3cIEebYXZf3FSkHWVl/qmeOlM9O
kYmeGoPKC/RX0uj7Whx+oiBEwQ1gzGKovt1sdXrn9X7zBMOb+LlOuVV7z2PQ
eQEY2dI2Y3bsGvle2ZTmu3ArRuqv4cAIrnxnkwWVx/7+JDZ+dQpblBiL5G4H
A4YzkuUwgdJu3a8OXWYgxjA3Qzr87SYUIRghCHRYM0rJi/57rIYmWcAawt6x
f7w13/vEvlj8QOMUnBSkPPpkKNbZYwx3q7a/CWsgbzvejH08eLwCFyvW4BVq
f0HI57rOPa7oRo+KPkWiAnBVdLyIvzyqW1Fgge8YuJxK9omAYDxnHkaFI4V1
o49jQlmYbAG3HCSHxstbJ+HR2Ee3j6yS8u9gq4NfEr9q6frd8trfGegDHcYE
52iah7TIR4IhMD8DmJt7ugZC2ynzkL5kmO+K+P9IWEsTXHcAAA==
</rfc> </rfc>
 End of changes. 68 change blocks. 
1155 lines changed or deleted 469 lines changed or added

This html diff was produced by rfcdiff 1.48.