ACTION-607 Propose changes in 5.4.1 to clarify end entity vs intermediaries

I believe consensus was reached that for expiration and revocation, we need to call out intermediate certificates as being a source of TLS errors. Also in some places we need to specify the end-entity certificate for some sections.

Here are my proposed changes (in red):

When, for a TLS-protected HTTP connection, the end-entity certificate presented or one of the intermediate certificates in the certificate chain are found to have been revoked, error signaling of class danger (6.4.3 Danger Messages) MUST be used.

When, for a TLS-protected HTTP connection, the end-entity certificate presented or one of the intermediate certificates in the certificate chain are found to have expired, error signaling of class danger (6.4.3 Danger Messages) MUST be used.

When the URL corresponding to the transaction at hand does not match the end-entity certificate presented, and a validated certificate  is used, then error signaling of level danger(6.4.3 Danger Messages) MUST be used.



Joe Steele