Repository navigation
Conversation
RFC 9846 obsoletes RFC 8446, so the normative reference now points to RFC 9846. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
Each registration entry in the IANA Considerations section wrote the term and value on one line, which rendered a doubled colon. The term and its value are now on separate lines. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
The HTTP/3 frame diagram wrote the variable-length field with three dots. The HTTP/2 diagram in the same document and RFC 9114 use two. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
The error code placeholder was written 0xERROR-TBD, while every other placeholder in the document is 0xTBD. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
The frame descriptions wrote "TLS Exported authenticator", while the rest of the document uses "TLS Exported Authenticators". Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
Section 7.4 capitalized "TLS-Terminated" mid-sentence and used it for the proxy, while other sections write "TLS-terminating" for the proxy and "TLS-terminated" for the request. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
Sections 1.3 and 3.1 capitalized "HTTP-Layer" in running text, while other running text uses "HTTP-layer". Headings keep Title Case. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
"CDN" is replaced by "content delivery network", and OCSP and SCT are expanded where they first appear. SNI is expanded in a later edit to the same section. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
The document describes a certificate chain sent "as a sequence of" frames and an authenticator field that is "a portion of" the opaque data. The design sends one authenticator in one SERVER_CERTIFICATE frame, so the text now says so. Raised by Mark Nottingham and Martin Thomson in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html and https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0292.html.
The sentence described a client requesting a general-purpose certificate or an anonymous ciphersuite at the TLS layer. No client can request certificates, and TLS 1.3 has no anonymous ciphersuites. The sentence now describes a server presenting a general-purpose certificate at the TLS layer and providing other certificates in HTTP. SNI is expanded in the same sentence. Raised by Mark Nottingham and Martin Thomson in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html and https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0292.html.
The Acknowledgments thanked Mike Bishop, who is a listed editor of this document, and did not name the document this one is based on. The predecessor is now named in prose. Raised by Mark Nottingham in https://lists.w3.org/Archives/Public/ietf-http-wg/2026JulSep/0194.html.
The HTTP/3 Settings registration had no Status field, which RFC 9114 Section 11.2 requires through RFC 9000 Section 22.1.1, and labeled the Value and Setting Name fields as Code and Name. Add "Status: permanent" and rename Code to Value (RFC 9000 Section 22.1.1) and Name to Setting Name (RFC 9114 Section 11.2.2), as the HTTP/3 Frame Types entry already does. Noticed during review; not raised on the list.
egorbaty
force-pushed
the
secondary-certs/wglc-editorial-review-1
branch
from
October 27, 2026 23:09
b65dbea to
df064b8
Compare
tfpauly
reviewed
Oct 28, 2026
| information is sensitive, it might be advantageous to request a general-purpose | ||
| certificate or anonymous ciphersuite at the TLS layer, while acquiring the | ||
| "real" certificate in HTTP after the connection is established. | ||
| Because the TLS Server Name Indication (SNI) extension is exchanged in the |
Contributor
There was a problem hiding this comment.
We should probably reference Encrypted Client Hello if we don't already, since it is a case where the real SNI is not in the clear.
Contributor
There was a problem hiding this comment.
Yes, this is effectively framed as an alternative to ECH -- and perhaps that's the correct framing. ECH can be seen from the outside (though you can't know whether it's grease or not), but this can't.
Contributor
Author
There was a problem hiding this comment.
I added a brief reference mentioning that the SNI is not in the clear with ECH. As for mike's point, perhaps we should follow up and expand upon that framing somewhere else in the document? It might be worth making this 'tradeoff' with ECH more apparent? Not sure if it makes sense to expand upon that in this section or later in the security considerations.
tfpauly
reviewed
Oct 28, 2026
|
|
||
| Value: : TBD | ||
| Value: | ||
| : TBD |
Contributor
There was a problem hiding this comment.
Separately from this PR, do we want to get the values requested?
Contributor
Author
There was a problem hiding this comment.
There are going to be some upcoming revisions to how the settings are negotiated which would affect interop with the current state of the draft but once we make those changes, yes, we'd probably want to get codepoints allocated.
MikeBishop
approved these changes
Oct 28, 2026
| information is sensitive, it might be advantageous to request a general-purpose | ||
| certificate or anonymous ciphersuite at the TLS layer, while acquiring the | ||
| "real" certificate in HTTP after the connection is established. | ||
| Because the TLS Server Name Indication (SNI) extension is exchanged in the |
Contributor
There was a problem hiding this comment.
Yes, this is effectively framed as an alternative to ECH -- and perhaps that's the correct framing. ECH can be seen from the outside (though you can't know whether it's grease or not), but this can't.
Co-authored-by: Mike Bishop <mbishop@evequefou.be>
Section 1.1 said SNI is always exchanged in the clear. With TLS Encrypted Client Hello it is not, so qualify the sentence and cite RFC 9849. Raised by Tommy Pauly on httpwg#3573
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some easy changes from WGLC reviews, more to come in follow-up PRs.