Re: [certid] It is not always a good idea to enforce CN check as leaf RDN only

[Joe Orton <[e-mail]>]

On Wed, Mar 17, 2010 at 04:43:27PM +0300, ArkanoiD wrote:
> Many self-signed certificates seem to have an email address as leaf
> RDN. I guess that's because openssl's CA.sh asks for the mail
> address. So with that additional constraint the scary warning
> dialogs for self-signed certs are going to be even more confusing in
> the future.

I agree with this; I can't think of any motivation for restricting the 
CN to only the most specific RDN.  To quantify whether or not it happens 
"in the wild", I looked at Johnathan Nightingale's database of SSL 
certs:

  http://blog.johnath.com/2009/01/21/ssl-information-wants-to-be-free/

The "top 10K sites" database has 2986 certs from public servers.  
Breaking down the tag of the most specific ("leaf") RDN in the Subject 
of each cert gives:

TAG         COUNT  % of TOTAL
C               9   0%
CN           2333  78%
emailAddress  596  19%
O               1   0%
OU             31   1%
serialNumber   10   0%
ST              6   0%

The draft looks good otherwise, BTW.

Regards, Joe