[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: prohibiting use of expired RRSIGs

> MAY be configurable as to whether to accept expired records.  If
> configurable,  SHOULD be
> configurable to as to the maximum out of date expired records can be to be
> acceptable.  And if configurable, MUST default to not accepting expired
> records.

Much better, but this loses the main sentiment of the original,
namely that one MUST NOT or SHOULD NOT use out-of-date (expired or
not yet active) RRSIGs.  The text above would allow a non-configurable
resolver to accept out-of-date records.

I have a broader proposal, which I'm about to post.

-- Sam

--
to unsubscribe send a message to namedroppers-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>