[certid] URI match

[Ludwig Nussel <[e-mail]>]

Hi,

What's the purpose of URIs in subjAltnames? Are they meant for
things like "https://example.com/"?

If so, does "telnet://example.com/" match "https://example.com/"? I
guess not as the URI schemes are different. The exact matching rules
for URIs are not defined in the I-D though.

The I-D allows multiple different types in subjAltnames so I guess
it's legal to have subjAltnames of type dNSName and
uniformResourceIdentifier in the same certificate. So a subjAltname
'URI:telnet://example.com/, DNS:example.com' would be valid. Assume
the user wants to connect to a server with that subjAltname and
enters 'https://example.com/' in the browser. Should that succeed?
Again I guess the URI doesn't match. However, when mapping the URI
to the host part only the dNSName would match and the connection
succeeds. Also, clients that don't support URIs in subjAltnames (as
almost all software out there) would ignore the URI and match
dNSName only.

So, without defining further constraints an URI in subjAltnames is
rather useless, isn't it?

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)