[certid] CN fallback

Ludwig Nussel <ludwig.nussel@suse.de> Tue, 23 March 2010 14:43 UTC

From: Ludwig Nussel <ludwig.nussel@suse.de>
To: certid@ietf.org
Date: Tue, 23 Mar 2010 15:44:05 +0100
User-Agent: KMail/1.12.4 (Linux/2.6.31.12-0.1-default; KDE/4.3.5; x86_64; ; )
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Message-Id: <201003231544.05651.ludwig.nussel@suse.de>
Subject: [certid] CN fallback
Precedence: list

Hi,

| If and only if the identity set does not include subjectAltName
| extensions of type dNSName, SRVName, uniformResourceIdentifier (or
| other application-specific subjectAltName extensions), the client MAY
| as a fallback check the value of the Common Name (CN)

What about rewording that to the following?

| If and only if the certificate does not include any subjectAltName
| extensions, the client MAY as a fallback check the value of the
| Common Name (CN)

That would avoid having generic implementations look into the CN as
fallback when it doesn't make sense. iPAddress for example isn't
specified by the I-D (why anyways?). So a conforming implementation
could use the CN when looking for a hostname even if a
subjectAltName of type iPAddress is present.

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

[certid] CN fallback Ludwig Nussel
Re: [certid] CN fallback Peter Saint-Andre
Re: [certid] CN fallback Alexey Melnikov
Re: [certid] CN fallback Scott Cantor
Re: [certid] CN fallback Alexey Melnikov
Re: [certid] CN fallback Scott Cantor
Re: [certid] CN fallback RL 'Bob' Morgan
Re: [certid] CN fallback Scott Cantor
Re: [certid] CN fallback Ludwig Nussel
[certid] open issue: iPAddress Peter Saint-Andre
Re: [certid] CN fallback Michael Ströder
Re: [certid] open issue: iPAddress Michael Ströder
Re: [certid] CN fallback Michael Ströder