IETF Logo Mail Archive

Re: [certid] CN-ID and name constraints

Peter Saint-Andre <stpeter@stpeter.im> Thu, 30 September 2010 19:27 UTC

Return-Path: <stpeter@stpeter.im>
X-Original-To: certid@core3.amsl.com
Delivered-To: certid@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A5A83A6E6E for <certid@core3.amsl.com>; Thu, 30 Sep 2010 12:27:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.552
X-Spam-Level:
X-Spam-Status: No, score=-102.552 tagged_above=-999 required=5 tests=[AWL=0.047, BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n-J5Z-PUKKzB for <certid@core3.amsl.com>; Thu, 30 Sep 2010 12:27:37 -0700 (PDT)
Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 6B3C23A6E6D for <certid@ietf.org>; Thu, 30 Sep 2010 12:27:37 -0700 (PDT)
Received: from dhcp-64-101-72-188.cisco.com (dhcp-64-101-72-188.cisco.com [64.101.72.188]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id E4C8740BB9; Thu, 30 Sep 2010 13:34:01 -0600 (MDT)
Message-ID: <4CA4E4D6.2020209@stpeter.im>
Date: Thu, 30 Sep 2010 13:28:22 -0600
From: Peter Saint-Andre <stpeter@stpeter.im>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.9) Gecko/20100915 Thunderbird/3.1.4
MIME-Version: 1.0
To: Jim Schaad <ietf@augustcellars.com>
References: <201009250309.o8P39Sc7016343@fs4113.wdf.sap.corp> <1285450341.1940.79.camel@mattlaptop2.local> <4CA3B1B0.2040106@stpeter.im> <006901cb6024$97c85990$c7590cb0$@augustcellars.com>
In-Reply-To: <006901cb6024$97c85990$c7590cb0$@augustcellars.com>
X-Enigmail-Version: 1.1.1
OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Cc: certid@ietf.org
Subject: Re: [certid] CN-ID and name constraints
X-BeenThere: certid@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Representation and verification of identity in certificates <certid.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/certid>
List-Post: <mailto:certid@ietf.org>
List-Help: <mailto:certid-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/certid>, <mailto:certid-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 30 Sep 2010 19:27:38 -0000

On 9/29/10 4:20 PM, Jim Schaad wrote:

> It was my understanding of this that the request was that the DNS name
> constraints be applied to a CN-ID that is being treated as a DN.  This would
> not be standard 5280 behavior.

That's a nice short summary of the issue. It seems to me that defining
such behavior might be within scope for an update to RFC 5280, but not
for the server-id-check document (since it is by no means intended to
update RFC 5280!).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

v2.8.7 | Report a Bug | By Email