Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 12
Abstract: The Extensible Authentication Protocol (EAP), defined in RFC 3748, provides a standard mechanism for support of multiple authentication methods. EAP-TLS and other TLS-based EAP methods are widely deployed and used for network access authentication. Large certificates and long certificate chains combined with authenticators that drop an EAP session after only 40 - 50 round trips is a major deployment problem. This document looks at this problem in detail and describes the potential solutions available.
Publication Date: 2022-02-01
Status Note: Informational
DOI: 10.17487/RFC9191
Link: https://doi.org/10.17487/RFC9191
Author(s): Mohit Sethi
John Preuß Mattsson
Sean Turner
Keyword(s): EAP-TLS, X.509, EAP, MTU, EAP Authenticator

Latest version of IETF RFC 9191

Document Versions — IETF RFC 9191

▶ IETF RFC 9191 (2022-02-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 3748 [Active*]
IETF RFC 4851 [Active*]
IETF RFC 5216 [Active*]
IETF RFC 5280 [Active, Amended*]
IETF RFC 5281 [Active*]
IETF RFC 7170 [Superseded*]
IETF RFC 8174 [Active*]
IETF RFC 8446 [Superseded*]
IETF RFC 9190 [Active*]

Bibliographic Reference(s)

10.1109-IEEESTD.2020.9018454 — IEEE-802.1X EXTERNAL
IETF draft-ietf-emu-tls-eap-types-04 [Active*]
IETF.draft-ietf-tls-ctls-04 — I-D.ietf-tls-ctls EXTERNAL
IETF.draft-mattsson-cose-cbor-cert-compress-08 — I-D.mattsson-cose-cbor-cert-compress EXTERNAL
IETF.draft-thomson-tls-sic-00 — I-D.thomson-tls-sic EXTERNAL
IETF.draft-tschofenig-tls-cwt-02 — I-D.tschofenig-tls-cwt EXTERNAL
MS.PEAP.20210625 — PEAP EXTERNAL
IETF RFC 2865 [Active*]
IETF RFC 5246 [Superseded*]
IETF RFC 6066 [Active*]
IETF RFC 6090 [Active*]
IETF RFC 7250 [Active*]
IETF RFC 7924 [Active*]
IETF RFC 8032 [Active*]
IETF RFC 8392 [Active*]
IETF RFC 8422 [Superseded*]
IETF RFC 8879 [Active*]
IETF RFC 8949 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9191.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9191, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods. Available at https://doi.org/10.17487/RFC9191

Snippet:

IETF RFC 9191, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods. Available at https://doi.org/10.17487/RFC9191

HTML (ISO 690 compliant)

Preview:

IETF RFC 9191, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods. Available at https://doi.org/10.17487/RFC9191

Snippet:

<span class="citation"><cite>IETF RFC 9191</cite>, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods. Available at <a href="https://doi.org/10.17487/RFC9191" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9191</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9191, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods
doi: 10.17487/RFC9191
url: https://doi.org/10.17487/RFC9191

Snippet:

<li>
<cite id="bib-rfc9191">IETF RFC 9191</cite>, Handling Large Certificates and Long Certificate Chains in TLS-Based EAP Methods
<span class="doi">10.17487/RFC9191</span>
</li>

Referenced By

IETF RFC 9190 [Active*]