freeipa

#9722 OCSP URI defaulted to http in default user cert profile
Closed: worksforme by threadcrux. Opened by threadcrux.

Closed: worksforme
Reopen Issue

Request for enhancement

Currently the base profiles (ex. IECUserRoles) use an http route as opposed to an https route for the definition of the Authority Information Access (OCSP), and it would be nice to have this default to https as a best practice and to minimize replay attacks.

Actual behavior

The default profiles provide an OCSP url of type http

            Authority Information Access: 
                OCSP - URI:http://ipa-ca.dev.local/ca/ocsp

Expected behavior

The default profiles should define OCSP and CRL uris with https

            Authority Information Access: 
                OCSP - URI:https://ipa-ca.dev.local/ca/ocsp

Version/Release/Distribution

(freeipa container)

ipa-server-4.12.2-6.el9.x86_64
ipa-client-4.12.2-6.el9.x86_64
389-ds-base-2.5.2-2.el9.x86_64
krb5-server-1.21.1-4.el9.x86_64

Additional info:

Example PEMs for root and user certificate generated with a default install and default IECUserRoles profile

Default User Cert Profile

policyset.serverCertSet.5.constraint.class_id=noConstraintImpl
policyset.serverCertSet.5.constraint.name=No Constraint
policyset.serverCertSet.5.default.class_id=authInfoAccessExtDefaultImpl
policyset.serverCertSet.5.default.name=AIA Extension Default
policyset.serverCertSet.5.default.params.authInfoAccessADEnable_0=true
policyset.serverCertSet.5.default.params.authInfoAccessADLocationType_0=URIName
policyset.serverCertSet.5.default.params.authInfoAccessADLocation_0=http://ipa-ca.dev.local/ca/ocsp
policyset.serverCertSet.5.default.params.authInfoAccessADMethod_0=1.3.6.1.5.5.7.48.1
policyset.serverCertSet.5.default.params.authInfoAccessCritical=false
policyset.serverCertSet.5.default.params.authInfoAccessNumADs=1
policyset.serverCertSet.9.constraint.name=No Constraint
policyset.serverCertSet.9.default.class_id=crlDistributionPointsExtDefaultImpl
policyset.serverCertSet.9.default.name=CRL Distribution Points Extension Default
policyset.serverCertSet.9.default.params.crlDistPointsCritical=false
policyset.serverCertSet.9.default.params.crlDistPointsEnable_0=true
policyset.serverCertSet.9.default.params.crlDistPointsIssuerName_0=CN=Certificate Authority,o=ipaca
policyset.serverCertSet.9.default.params.crlDistPointsIssuerType_0=DirectoryName
policyset.serverCertSet.9.default.params.crlDistPointsNum=1
policyset.serverCertSet.9.default.params.crlDistPointsPointName_0=http://ipa-ca.dev.local/ipa/crl/MasterCRL.bin
policyset.serverCertSet.9.default.params.crlDistPointsPointType_0=URIName
policyset.serverCertSet.9.default.params.crlDistPointsReasons_0=

USER

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2 (0x2)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=DEV.LOCAL, CN=Certificate Authority
        Validity
            Not Before: Dec 29 23:41:15 2024 GMT
            Not After : Dec 19 23:41:15 2026 GMT
        Subject: O=DEV.LOCAL, CN=OCSP Subsystem
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:e0:98:fd:78:d9:4c:7f:02:82:a7:17:4f:b0:d0:
                    ae:88:b1:d6:e8:dc:16:ec:8d:4a:ab:fd:d2:c6:67:
                    52:de:bd:72:6e:87:77:bc:95:f1:8f:0a:8c:e4:dc:
                    fa:09:37:aa:46:7b:09:06:6a:b8:68:d2:d7:22:8b:
                    85:08:bf:61:cb:50:1b:60:15:77:fe:9b:95:d9:94:
                    80:2b:6f:3c:7f:4b:03:09:63:c9:df:60:84:bd:ca:
                    d0:8c:6d:88:71:14:bc:71:8f:b3:be:23:3e:b6:d8:
                    7b:c3:76:0e:3f:1a:25:3c:39:22:49:ae:3e:7f:c7:
                    2c:ba:5e:4f:04:a0:11:13:32:89:5b:ff:a2:55:e6:
                    8f:05:50:25:8a:01:2b:25:68:8c:c5:01:5f:ac:9f:
                    59:ac:a3:1d:6e:2e:0b:79:ef:14:d7:7d:d6:02:ba:
                    10:0c:08:42:99:85:72:57:c0:e7:17:d8:8e:ea:95:
                    68:c9:82:31:64:d5:2f:cc:6c:ec:55:a4:03:7f:21:
                    97:62:83:c6:f4:67:df:21:19:42:23:5a:e6:28:aa:
                    19:15:ca:06:5c:e4:6a:d7:4d:a7:c7:7b:d9:44:d2:
                    0d:cf:be:0d:7b:56:ba:7e:17:a4:69:ab:b8:ae:f8:
                    48:2b:77:a5:c4:51:08:c3:dc:d1:8d:df:3d:52:9c:
                    62:8d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                6A:74:DE:C5:3B:9D:CC:AC:8F:83:B6:7C:8B:A3:4A:F6:0D:88:DE:AF
            Authority Information Access: 
                OCSP - URI:http://ipa-ca.dev.local/ca/ocsp
            X509v3 Extended Key Usage: 
                OCSP Signing
            OCSP No Check: 
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        62:d9:33:ea:97:7a:af:3a:ad:eb:c0:1b:b1:22:42:05:6e:e4:
        9b:83:d9:7b:ff:36:8f:b4:44:54:dd:48:32:5d:61:82:70:67:
        a8:2a:ed:cd:2c:2a:95:b2:14:5f:a1:2d:fc:52:05:0e:c3:d4:
        3b:c4:21:b9:0e:06:20:8e:21:de:e8:2d:43:f5:1d:1c:b7:4d:
        8b:0d:5b:dc:bd:5f:8c:b0:2b:ba:7d:13:0e:fd:92:45:e6:64:
        2b:4a:09:c6:9f:58:b2:e0:45:50:8a:d1:04:7f:2f:36:c8:05:
        62:7c:bb:11:14:fb:7b:c4:c6:04:bc:64:d2:5a:a5:f4:a2:f8:
        31:8f:4d:d1:9d:a3:9e:10:0d:b4:63:cc:30:c1:ef:73:50:12:
        f6:87:67:71:6c:b1:ab:8f:70:fe:d0:10:53:b1:2e:16:5e:9a:
        9d:53:52:d5:34:77:f6:d9:94:86:b8:09:62:52:6c:40:23:1f:
        38:ad:99:10:f9:53:71:3e:df:2c:a0:61:ed:61:28:96:e6:f1:
        2d:1c:75:a1:a2:ef:3c:a7:7e:8a:35:a9:56:85:8e:bc:87:56:
        d0:e0:a9:87:46:ca:9c:af:f7:7c:d9:92:ed:66:8f:ff:df:fd:
        4e:65:1f:ae:b7:4d:db:02:34:a9:a4:24:3e:55:a2:a5:18:ca:
        12:66:91:32:25:2c:08:2e:18:da:7a:9d:86:a3:ab:f7:51:32:
        da:fb:6b:ca:1b:01:05:d1:f9:04:91:31:11:c2:08:4d:35:1e:
        2f:24:fc:97:fa:4d:48:a4:65:77:a0:49:a7:bf:d8:c1:15:59:
        99:49:92:4c:15:59:d7:36:cb:5d:c0:7f:49:d5:09:5e:b0:b2:
        c1:4f:11:5e:a3:42:7a:44:37:ea:83:52:49:fd:46:0a:c0:ae:
        cb:27:d3:9e:3c:c3:be:3e:ed:aa:a4:7e:b5:01:72:b1:5f:10:
        f2:72:2b:ff:ce:b3:21:6a:4d:bd:a2:62:3c:03:ae:b5:f7:91:
        8c:88:50:5c:82:ee
-----BEGIN CERTIFICATE-----
MIID5DCCAkygAwIBAgIBAjANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlERVYu
TE9DQUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yNDEyMjky
MzQxMTVaFw0yNjEyMTkyMzQxMTVaMC0xEjAQBgNVBAoMCURFVi5MT0NBTDEXMBUG
A1UEAwwOT0NTUCBTdWJzeXN0ZW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQDgmP142Ux/AoKnF0+w0K6Isdbo3BbsjUqr/dLGZ1LevXJuh3e8lfGPCozk
3PoJN6pGewkGarho0tcii4UIv2HLUBtgFXf+m5XZlIArbzx/SwMJY8nfYIS9ytCM
bYhxFLxxj7O+Iz622HvDdg4/GiU8OSJJrj5/xyy6Xk8EoBETMolb/6JV5o8FUCWK
ASslaIzFAV+sn1msox1uLgt57xTXfdYCuhAMCEKZhXJXwOcX2I7qlWjJgjFk1S/M
bOxVpAN/IZdig8b0Z98hGUIjWuYoqhkVygZc5GrXTafHe9lE0g3Pvg17Vrp+F6Rp
q7iu+Egrd6XEUQjD3NGN3z1SnGKNAgMBAAGjgYcwgYQwHwYDVR0jBBgwFoAUanTe
xTudzKyPg7Z8i6NK9g2I3q8wOwYIKwYBBQUHAQEELzAtMCsGCCsGAQUFBzABhh9o
dHRwOi8vaXBhLWNhLmRldi5sb2NhbC9jYS9vY3NwMBMGA1UdJQQMMAoGCCsGAQUF
BwMJMA8GCSsGAQUFBzABBQQCBQAwDQYJKoZIhvcNAQELBQADggGBAGLZM+qXeq86
revAG7EiQgVu5JuD2Xv/No+0RFTdSDJdYYJwZ6gq7c0sKpWyFF+hLfxSBQ7D1DvE
IbkOBiCOId7oLUP1HRy3TYsNW9y9X4ywK7p9Ew79kkXmZCtKCcafWLLgRVCK0QR/
LzbIBWJ8uxEU+3vExgS8ZNJapfSi+DGPTdGdo54QDbRjzDDB73NQEvaHZ3FssauP
cP7QEFOxLhZemp1TUtU0d/bZlIa4CWJSbEAjHzitmRD5U3E+3yygYe1hKJbm8S0c
daGi7zynfoo1qVaFjryHVtDgqYdGypyv93zZku1mj//f/U5lH663TdsCNKmkJD5V
oqUYyhJmkTIlLAguGNp6nYajq/dRMtr7a8obAQXR+QSRMRHCCE01Hi8k/Jf6TUik
ZXegSae/2MEVWZlJkkwVWdc2y13Af0nVCV6wssFPEV6jQnpEN+qDUkn9RgrArssn
0548w74+7aqkfrUBcrFfEPJyK//OsyFqTb2iYjwDrrX3kYyIUFyC7g==
-----END CERTIFICATE-----

ROOT

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: O=DEV.LOCAL, CN=Certificate Authority
        Validity
            Not Before: Dec 29 23:41:09 2024 GMT
            Not After : Dec 29 23:41:09 2044 GMT
        Subject: O=DEV.LOCAL, CN=Certificate Authority
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (3072 bit)
                Modulus:
                    00:bb:4b:c5:78:14:4e:17:e4:8c:69:53:75:ad:a2:
                    20:5e:78:fa:88:60:ad:09:0d:39:cd:25:1d:90:e5:
                    e6:8c:fe:f6:06:35:f0:c0:84:7b:ca:cc:3a:e8:59:
                    5f:58:19:0b:53:e3:ff:1d:7d:9e:25:03:4d:e3:46:
                    3a:a8:9c:e7:af:7e:47:61:5f:40:10:d8:7b:bc:81:
                    f0:45:2a:a6:81:48:cf:1c:f0:6f:d1:95:47:12:82:
                    8a:3d:9a:66:15:23:e0:d5:0f:c5:65:87:a2:d1:6d:
                    7c:11:1d:82:71:5c:b6:b9:8f:33:cb:da:87:d1:32:
                    ce:09:f9:7c:01:9a:df:29:72:cf:90:c3:14:8b:3c:
                    53:e8:6f:28:04:8a:59:88:d0:a9:cd:a0:58:a8:a9:
                    83:9d:e4:0c:43:67:e3:02:80:d5:82:12:37:ea:2a:
                    cd:95:06:11:84:0e:fe:bc:db:3e:58:b1:2a:82:40:
                    0e:ea:94:63:8d:0d:a8:4d:5d:86:92:97:54:28:32:
                    6e:35:d7:1e:66:02:50:e6:e1:7b:bd:4e:a0:e9:23:
                    a4:a4:6a:7f:af:59:13:c7:a5:f3:ba:84:1a:ad:f0:
                    be:d0:f0:58:e1:23:eb:84:c4:2d:39:86:b1:88:ad:
                    10:a1:bb:ba:9c:c2:b8:7d:7e:b0:bd:c9:e8:a7:52:
                    f1:31:9c:32:30:66:f5:a0:75:e2:53:ab:20:22:2a:
                    40:3f:4c:af:86:2d:38:e1:5c:40:ab:c3:52:3a:94:
                    20:da:e2:ce:be:c1:00:90:7f:cf:3b:1a:40:46:b7:
                    25:24:ac:7e:b3:a8:f7:6c:de:8c:49:85:9e:4e:43:
                    a6:20:7d:02:35:a1:a7:8f:b3:36:94:4e:19:a4:b0:
                    e1:ed:25:96:11:30:f4:23:28:7f:6d:5e:e0:6d:29:
                    1f:0e:43:d6:21:f8:4f:02:6b:38:93:ee:45:93:09:
                    88:8f:93:3d:4c:69:9f:a9:f6:aa:a5:91:e6:18:0e:
                    0c:4e:79:21:4b:00:1f:0d:6d:41
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                6A:74:DE:C5:3B:9D:CC:AC:8F:83:B6:7C:8B:A3:4A:F6:0D:88:DE:AF
            X509v3 Authority Key Identifier: 
                6A:74:DE:C5:3B:9D:CC:AC:8F:83:B6:7C:8B:A3:4A:F6:0D:88:DE:AF
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        8e:93:ad:6f:a7:ce:35:bd:24:80:6c:eb:fb:1d:8d:dd:6f:11:
        72:81:c9:0a:12:b4:1c:09:c3:84:ba:ed:82:78:c1:60:b9:3d:
        79:3b:21:46:68:0e:9e:04:e3:9e:0b:09:e2:b7:5c:85:fe:c2:
        10:b5:21:05:ff:8e:d7:57:37:df:d1:b2:d4:fe:68:c0:63:6a:
        4e:79:70:c9:90:f9:ac:61:eb:1c:c6:a1:78:de:8e:49:48:04:
        39:7c:97:37:93:2b:60:9e:bd:38:bd:e1:25:f6:13:e1:9b:8a:
        4b:01:fa:82:37:d5:d8:4a:1e:90:ea:72:99:ff:6f:e1:ea:79:
        45:ec:73:6a:48:47:b4:0e:bb:de:a0:20:f5:f4:8c:6a:c0:bb:
        14:7e:6c:c1:d6:ef:a9:63:40:d2:cd:61:11:5f:ee:6b:ce:2a:
        28:57:58:7a:ac:22:c3:8a:4e:13:6b:da:e7:31:47:11:c3:32:
        1c:49:8d:12:71:4d:b7:4f:c0:b7:94:34:09:0e:58:8a:7a:8d:
        87:e9:b1:27:63:cf:2b:7c:a6:76:db:5b:a6:d7:e0:3f:20:a7:
        d3:ac:1d:05:a6:34:e3:27:33:76:7b:f2:1c:c5:c6:7a:95:ef:
        31:33:e8:b3:f8:ff:14:03:12:b7:ba:79:91:4c:c9:ed:b7:fc:
        44:9d:5e:d6:45:49:12:7d:87:99:cb:6f:d6:77:7f:a4:a6:04:
        89:1b:e4:69:ad:92:d1:2c:9b:58:be:16:5e:f1:fc:fa:03:38:
        be:2d:8b:fe:17:a9:1c:8a:9b:29:d2:17:33:c2:e9:da:3e:65:
        dc:9e:ee:ca:20:c7:c3:2d:c3:3a:46:be:98:0e:f7:1a:ad:59:
        cd:7c:5a:6b:0e:0d:e7:78:22:aa:33:c7:bf:c3:d2:5f:70:b5:
        a3:b7:04:25:55:bb:ff:d8:76:28:f0:87:c9:a8:f3:53:59:3b:
        92:b3:24:eb:34:83:d3:94:13:ce:45:64:4a:12:4b:c4:f6:d8:
        51:67:38:14:5d:f7
-----BEGIN CERTIFICATE-----
MIIERjCCAq6gAwIBAgIBATANBgkqhkiG9w0BAQsFADA0MRIwEAYDVQQKDAlERVYu
TE9DQUwxHjAcBgNVBAMMFUNlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0yNDEyMjky
MzQxMDlaFw00NDEyMjkyMzQxMDlaMDQxEjAQBgNVBAoMCURFVi5MT0NBTDEeMBwG
A1UEAwwVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBojANBgkqhkiG9w0BAQEFAAOC
AY8AMIIBigKCAYEAu0vFeBROF+SMaVN1raIgXnj6iGCtCQ05zSUdkOXmjP72BjXw
wIR7ysw66FlfWBkLU+P/HX2eJQNN40Y6qJznr35HYV9AENh7vIHwRSqmgUjPHPBv
0ZVHEoKKPZpmFSPg1Q/FZYei0W18ER2CcVy2uY8zy9qH0TLOCfl8AZrfKXLPkMMU
izxT6G8oBIpZiNCpzaBYqKmDneQMQ2fjAoDVghI36irNlQYRhA7+vNs+WLEqgkAO
6pRjjQ2oTV2GkpdUKDJuNdceZgJQ5uF7vU6g6SOkpGp/r1kTx6XzuoQarfC+0PBY
4SPrhMQtOYaxiK0Qobu6nMK4fX6wvcnop1LxMZwyMGb1oHXiU6sgIipAP0yvhi04
4VxAq8NSOpQg2uLOvsEAkH/POxpARrclJKx+s6j3bN6MSYWeTkOmIH0CNaGnj7M2
lE4ZpLDh7SWWETD0Iyh/bV7gbSkfDkPWIfhPAms4k+5FkwmIj5M9TGmfqfaqpZHm
GA4MTnkhSwAfDW1BAgMBAAGjYzBhMB0GA1UdDgQWBBRqdN7FO53MrI+DtnyLo0r2
DYjerzAfBgNVHSMEGDAWgBRqdN7FO53MrI+DtnyLo0r2DYjerzAPBgNVHRMBAf8E
BTADAQH/MA4GA1UdDwEB/wQEAwIBxjANBgkqhkiG9w0BAQsFAAOCAYEAjpOtb6fO
Nb0kgGzr+x2N3W8RcoHJChK0HAnDhLrtgnjBYLk9eTshRmgOngTjngsJ4rdchf7C
ELUhBf+O11c339Gy1P5owGNqTnlwyZD5rGHrHMaheN6OSUgEOXyXN5MrYJ69OL3h
JfYT4ZuKSwH6gjfV2EoekOpymf9v4ep5RexzakhHtA673qAg9fSMasC7FH5swdbv
qWNA0s1hEV/ua84qKFdYeqwiw4pOE2va5zFHEcMyHEmNEnFNt0/At5Q0CQ5YinqN
h+mxJ2PPK3ymdttbptfgPyCn06wdBaY04yczdnvyHMXGepXvMTPos/j/FAMSt7p5
kUzJ7bf8RJ1e1kVJEn2Hmctv1nd/pKYEiRvkaa2S0SybWL4WXvH8+gM4vi2L/hep
HIqbKdIXM8Lp2j5l3J7uyiDHwy3DOka+mA73Gq1ZzXxaaw4N53giqjPHv8PSX3C1
o7cEJVW7/9h2KPCHyajzU1k7krMk6zSD05QTzkVkShJLxPbYUWc4FF33
-----END CERTIFICATE-----

I believe you can already set things up without any modification of FreeIPA.

You can set up IPA deployment with a custom OCSP URL using --pki-config-override=/path/to/override.ini for ipa-server-install/ipa-replica-install/ipa-ca-install. See man page for ipa-server-install, pki_default.cfg, /usr/share/ipa/ipaca_customize.ini and /usr/share/ipa/ipaca_default.ini

[DEFAULT]
ipa_ocsp_uri=https://ipa-ca.dev.local/ca/ocsp

I haven't tried that myself. We have a test ipatests/test_integration/test_pki_config_override.py that demonstrates how to use it. The override file cannot override certain options (called immutable keys in the code), mostly keys from ipaca_default.ini. However, ipa_ocsp_uri is not part of those immutable keys so it can be set through the override file.

This value will be propagated to pki_default_ocsp_uri (which cannot be changed directly as it is the key in ipaca_default.ini) and will be used by the PKI to provision values in the certificate templates.

Apart from that, /ca/ocsp endpoint is already accessible over HTTPS.

Switching to HTTPS endpoint by default has another set of issues in itself. There is a bootstrapping problem: IPA CA OCSP endpoint accessible only over HTTPS makes an initial verification not possible without not trusting the CA who issued that HTTPS end-point's certificate. It could be the same CA, it could be a third-party CA, we cannot know in advance and it pretty much depends on the OCSP client behavior. HTTP is typically used for OCSP responders due to OCSP content being already signed by the CA.

PKI has support for OCSP nonce-based authentication which prevents replay attacks but it depends on the client side to trigger that. If we change an OCSP template to force use of OID 1.3.6.1.5.5.7.48.1.2, one needs to make it a mandatory (critical:TRUE) property or otherwise clients will be able to downgrade their requests and will be susceptible to the replay attacks as well. But how many clients do force OCSP nonce use?

Let me know if this is enough.

@abbra

You can set up IPA deployment with a custom OCSP URL using --pki-config-override=/path/to/override.ini for ipa-server-install/ipa-replica-install/ipa-ca-install. See man page for ipa-server-install, pki_default.cfg, /usr/share/ipa/ipaca_customize.ini and /usr/share/ipa/ipaca_default.ini

Perfect, that will work in most situations and for my immediate needs

IPA CA OCSP endpoint accessible only over HTTPS makes an initial verification not possible without not trusting the CA who issued that HTTPS end-point's certificate.

HTTP is typically used for OCSP responders due to OCSP content being already signed by the CA.

Totally see your point here and this is a weird case of chicken or egg. My thinking is by needing to validate such certificate from the CA that the CA should already trusted, but there are cases where it might not be.

But how many clients do force OCSP nonce use?

not enough...but that is a question for another day

Let me know if this is enough.

I appreciate the indepth response! The concerns behind my original issue were mainly from the bootstrapping phase (initial setup of PKI) of FreeIPA and you have covered that, you hit the nail on the head, thank you

Metadata Update from @threadcrux:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)

@abbra

Thanks again, that comment helped a lot. I'm fairly new to FreeIPA, I've been using all of it's subsystems for a while (Kerberos, BIND, 389) but have become tired of managing it through my own half baked ipa like system.

Based on your example configuration I was able to track down how the conf gets validated and injected aswell
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.