2.1 Client A 2.1 Client" is any software that conforms to the following normative requirements: It MUST support all requirements for a TAXII Collections Client as defined in section . TAXII™ 2.1 Collections Client A "TAXII 2.1 Collections Client" is any software that exchanges CTI data with a TAXII 2.1 Collections Server or a TAXII 2.1 Server. A TAXII 2.1 Collections Client conforms to the following normative requirements: It SHOULD be capable of looking up and the TAXII SRV record from DNS. It MUST support parsing all properties for resources defined in section and section . It MUST support all features listed in section , Mandatory Client Features. TAXII™ 2.1 Channels Client RESERVED Mandatory Client Features This section defines the mandatory features that all TAXII Clients MUST support. and Authentication Client Requirements It MUST initiate TAXII 2.1 requests to a TAXII 2.1 Server using HTTPS []. It MUST support TLS 1.2 and SHOULD use TLS version 1.3 [] or higher It SHOULD NOT use TLS 1.2 with any of the cipher suites that are listed in the cipher suite blacklist in Appendix A of [. It MUST implement the HTTP authentication scheme as a client per []. It implement additional authentication and authorization schemes beyond HTTP Basic, see MAY section . Server Certificate Verification The default strategy for TAXII Clients authenticating and verifying the server's TLS certificate be PKIX as defined in [, [, [ et al. SHOULD TAXII Clients MAY support other certification verification policies such as: Certificate Pinning: A single or limited set of either hard-coded or physically distributed pinned certificate authorities or end-entity certificates. DANE: DNS-based Authentication of Named Entities []. Systems implementing DANE SHOULD also implement DNSSEC []. Note that Self-Signed Certificates (like other certificates which cannot be verified by PKIX) MAY be supported via Certificate Pinning and/or DANE as noted above.
2.1 Client A 2.1 Client" is any software that conforms to the following normative requirements: It MUST support all requirements for a TAXII Collections Client as defined in section . TAXII™ 2.1 Collections Client A "TAXII 2.1 Collections Client" is any software that exchanges CTI data with a TAXII 2.1 Collections Server or a TAXII 2.1 Server. A TAXII 2.1 Collections Client conforms to the following normative requirements: It SHOULD be capable of looking up and the TAXII SRV record from DNS. It MUST support parsing all properties for resources defined in section and section . It MUST support all features listed in section , Mandatory Client Features. TAXII™ 2.1 Channels Client RESERVED Mandatory Client Features This section defines the mandatory features that all TAXII Clients MUST support. and Authentication Client Requirements It MUST initiate TAXII 2.1 requests to a TAXII 2.1 Server using HTTPS []. It MUST support TLS 1.2 and SHOULD use TLS version 1.3 [] or higher It SHOULD NOT use TLS 1.2 with any of the cipher suites that are listed in the cipher suite blacklist in Appendix A of [. It MUST implement the HTTP authentication scheme as a client per []. It MAY implement additional authentication and authorization schemes beyond HTTP Basic, see section . Server Certificate Verification The default strategy for TAXII Clients authenticating and verifying the server's TLS certificate SHOULD be PKIX as defined in [, [, [ et al. TAXII Clients MAY support other certification verification policies such as: Certificate Pinning: A single or limited set of either hard-coded or physically distributed pinned certificate authorities or end-entity certificates. DANE: DNS-based Authentication of Named Entities []. Systems implementing DANE SHOULD also implement DNSSEC []. Note that Self-Signed Certificates (like other certificates which cannot be verified by PKIX) MAY be supported via Certificate Pinning and/or DANE as noted above.