22:00:15 <RRSAgent> RRSAgent has joined #httpslocal
22:00:15 <RRSAgent> logging to https://www.w3.org/2017/11/08-httpslocal-irc
22:01:09 <tomoyuki> rrsagent, make minutes public
22:01:09 <RRSAgent> I'm logging. I don't understand 'make minutes public', tomoyuki.  Try /msg RRSAgent help
22:02:06 <tomoyuki> rrsagent, make minutes
22:02:06 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html tomoyuki
22:02:23 <tomoyuki> RRSAgent, make minutes v2
22:02:23 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html tomoyuki
22:02:54 <tomoyuki> RRSAgent, set minutes public
22:02:54 <RRSAgent> I'm logging. I don't understand 'set minutes public', tomoyuki.  Try /msg RRSAgent help
22:04:00 <minami> minami has joined #httpslocal
22:04:31 <komasshu> komasshu has joined #httpslocal
22:04:52 <urata_> urata_ has joined #httpslocal
22:04:57 <YoshiroYoneya> Tomoyuki started the session.
22:04:59 <igarashi> igarashi has joined #httpslocal
22:05:31 <gmandyam> gmandyam has joined #httpslocal
22:05:47 <YoshiroYoneya> In this session, we want to discuss about how to deploy https in local network.
22:06:19 <Magnus> Magnus has joined #httpslocal
22:06:29 <vincentK> vincentK has joined #httpslocal
22:06:35 <vincentK> present+
22:06:57 <YoshiroYoneya> Goal: To connect various devices/browsers to local network with https.
22:07:08 <Geun_Hyung> Geun_Hyung has joined #httpslocal
22:07:27 <Geun_Hyung> present+ Geun_Hyung
22:07:48 <YoshiroYoneya> Issues: Browsers requires secure context, but devices provide mixed content.
22:07:57 <Magnus> present+
22:08:05 <wooLim> wooLim has joined #httpslocal
22:08:10 <Kyosuke> Kyosuke has joined #httpslocal
22:08:58 <YoshiroYoneya> Let's Encrypt requires internet connectivity, so it is not applicable to local network.
22:09:23 <YoshiroYoneya> How can we do for local network devices?
22:09:50 <YoshiroYoneya> HTTPS in Local Network CG is focusing the issue.
22:10:30 <YoshiroYoneya> The CG is discussing use cases for this several months.
22:10:58 <YoshiroYoneya> Home network, automotive, IoTs are in scope.
22:11:16 <YoshiroYoneya> The CG is also discussing requirements.
22:11:35 <Hexcles_> Hexcles_ has joined #httpslocal
22:12:51 <YoshiroYoneya> First, device discovery and identification.
22:13:01 <YoshiroYoneya> Second, how to grant certificates.
22:13:27 <YoshiroYoneya> Third, certificate validation.
22:14:27 <YoshiroYoneya> We need secure, safe and easy mechanisms to use valid certificates in local network.
22:14:52 <Hexcles_> RRSAgent: draft minutes
22:14:52 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html Hexcles_
22:15:35 <YoshiroYoneya> Today's presentations are for raising discussion, so they are not limited the use cases or situations.
22:16:47 <Kyosuke__> Kyosuke__ has joined #httpslocal
22:17:09 <YoshiroYoneya> Comment: If devices have other access methods, it should be considered.
22:17:25 <horo> horo has joined #httpslocal
22:17:26 <YoshiroYoneya> Daisuke started presentation.
22:17:29 <snishimura> snishimura has joined #httpslocal
22:18:00 <YoshiroYoneya> A) Public CA Certificate
22:18:08 <Hexcles> rrsagent: make log public
22:18:13 <YoshiroYoneya> B) Private CA Certificate.
22:18:29 <YoshiroYoneya> C) Self signed Certificate.
22:18:40 <komasshu> s/Comment:/komasshu/
22:19:36 <jdai> jdai has joined #httpslocal
22:19:46 <YoshiroYoneya> Example of Public CA Certificate, PLEX's solution.
22:19:47 <tomoyuki> tomoyuki has joined #httpslocal
22:19:58 <tomoyuki> RRSAgent, set logs world-visible
22:20:11 <tomoyuki> RRSAgent, make minutes v2
22:20:11 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html tomoyuki
22:20:45 <tomoyuki> Present+ Tomoyuki_Shimizu
22:21:07 <YoshiroYoneya> Pros: no need to extend UA implementation.
22:21:53 <tomoyuki> Present+ Daisuke_Ajitomi, Tatsuya_Igarashi
22:22:19 <YoshiroYoneya> Cons: UA can't access the device when the internet is down, domain names and IP addresses are disclosed globally, Billions of TLS-capable IoTs have to registered to DNS.
22:22:30 <tomoyuki> Chair: tomoyuki
22:23:08 <YoshiroYoneya> Private CA Certificate case, Pros: UA can access device even if the internret is down.
22:23:13 <tomoyuki> Agenda: https://www.w3.org/wiki/TPAC/2017/SessionIdeas#HTTPS_in_Local_Network
22:23:21 <YoshiroYoneya> Cons: This kind of certificate is not permitted by UA.
22:23:34 <tomoyuki> Meeting: HTTPS in Local Network breakout
22:23:53 <YoshiroYoneya> Private CA certificate example, ACME's OoB challange for TLS servers in local network.
22:24:39 <YoshiroYoneya> ACME is generalized protocol for Let's Encrypt.
22:26:38 <YoshiroYoneya> In this case, Private CA doesn't need device discovery because it knows the device name by OAuth authorization.
22:26:55 <YoshiroYoneya> Self signed Certificate.
22:27:41 <YoshiroYoneya> Pros: UA can access the device even if the internet is down.
22:27:50 <YoshiroYoneya> Cons: (sorry missed).
22:28:34 <YoshiroYoneya> Cons: There is no trust in the certificate, there is no way to revoke the certificate when the device is imperiled.
22:29:16 <YoshiroYoneya> for A) we need some improvements on DNS.
22:29:30 <YoshiroYoneya> for B) we need some strict conditions.
22:29:44 <YoshiroYoneya> for C) we should eliminate this idea.
22:30:05 <tomoyuki> Topic: discussions about different trust levels of server certificates
22:31:03 <YoshiroYoneya> ? Is ACME's Out-of-Band an extended protocol?
22:31:15 <YoshiroYoneya> Daisuke: Yes.
22:32:15 <YoshiroYoneya> Another idea is to use QR code for OoB challange.
22:33:05 <YoshiroYoneya> ?: IoT devices needs this solution.
22:33:30 <YoshiroYoneya> ?: Is this solution only applicable to UA to machine?
22:33:53 <YoshiroYoneya> Daisuke: IMO, this is not applicable to M2M.
22:35:52 <YoshiroYoneya> ?: Do you have discovery registry mechanism?
22:36:34 <YoshiroYoneya> Smart TV is one of the case.
22:37:10 <YoshiroYoneya> ?: The discovery mechanism have to have trust.
22:38:21 <YoshiroYoneya> Tatsuya: mDNS does not provide trust, currently no mechanism to provide trust.
22:39:17 <YoshiroYoneya> ?: (off-line environment).
22:40:01 <YoshiroYoneya> Tatsuya: on line enviromnent is required only for Certificate issurance.
22:41:33 <YoshiroYoneya> ?: If WebRTC or such kind of APIs are provided, it would be work for this issue.
22:42:33 <YoshiroYoneya> Tatsuya: WebSocket and/or TLS need this mechanism.
22:44:30 <YoshiroYoneya> Tatsuya: We'd like to challenge local devices be part of network.
22:44:42 <YoshiroYoneya> Tatsuya started presentaion.
22:45:06 <YoshiroYoneya> HTTPS in localnetwork featuring STAR.
22:45:09 <tomoyuki_> tomoyuki_ has joined #httpslocal
22:45:15 <tomoyuki_> Topic: HTTPS in Local Network featuring STAR
22:45:45 <YoshiroYoneya> STAR: proposal to extend ACME protocol.
22:46:21 <tomoyuki_> FYI: ACME STAR I-D: https://tools.ietf.org/html/draft-ietf-acme-star-00
22:46:22 <YoshiroYoneya> Short-Term, Automatically-Renewed (STAR) Certificates.
22:47:21 <tantek> tantek has joined #httpslocal
22:47:22 <YoshiroYoneya> Main use case of STAR is CDN.
22:48:40 <komasshu> komasshu has joined #httpslocal
22:49:02 <YoshiroYoneya> An idea to use STAR in local network.
22:49:53 <YoshiroYoneya> STAR client (NDC) is in local network, which can connect STAR Proxy (DNO) on the internet.
22:50:31 <YoshiroYoneya> STAR Proxy would be device ventors.
22:50:46 <tomoyuki_> s/ventors/vendors/
22:51:15 <YoshiroYoneya> The issue is the UA side.
22:51:39 <YoshiroYoneya> UA should support some discovery mechanism.
22:53:29 <YoshiroYoneya> A scenario is to verify CNAME and SNI matching.
22:54:33 <YoshiroYoneya> Not to connect malicious IoT, use content is required.
22:55:26 <YoshiroYoneya> Similar discussion was occured at Let's Encrypt community.
22:57:14 <tomoyuki_> RRSAgent, make minutes v2
22:57:14 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html tomoyuki_
22:57:15 <YoshiroYoneya> Example of device selection, pre-flight succession appears green on the user pop-up dialog.
22:57:54 <YoshiroYoneya> ?: pre-flight TLS is q regular TLS mechanism.
22:59:15 <YoshiroYoneya> Tatsuya: even for M2M connection, initial confirmation is required.
22:59:51 <YoshiroYoneya> ?: Local DNS configuration with DANE may be useful.
23:00:35 <YoshiroYoneya> Tatsuya: Public CA is important to trust local web servers.
23:01:32 <YoshiroYoneya> ?: In TLS1.3, SNI is encrypted.
23:02:12 <YoshiroYoneya> Osamu: What is next step of this activity?
23:02:31 <YoshiroYoneya> Tatsuya: facilitate more discussion in W3C.
23:03:04 <YoshiroYoneya> Osamu: This discussion seems protocol definition, isn't it IETF work?
23:03:41 <YoshiroYoneya> Tatsuya: collaboration between W3C and IETF is needed.
23:05:28 <YoshiroYoneya> Tomoyuki: We need more help :-)
23:05:37 <YoshiroYoneya> (sorry for poor scribing)
23:08:24 <tomoyuki_> RRSAgent, make minutes v2
23:08:24 <RRSAgent> I have made the request to generate https://www.w3.org/2017/11/08-httpslocal-minutes.html tomoyuki_
23:08:41 <tomoyuki_> RRSAgent, bye
23:08:41 <RRSAgent> I see no action items