Re: [keyassure] CN/SAN matching (was: End entity certificate matching, trust anchors, and protocol-06)

[Paul Wouters <[e-mail]>]

On Mon, 21 Mar 2011, Paul Hoffman wrote:

>> Why is it needed in the first place?
>
>
> That's a very good question. I don't feel that it is a "need", but it "makes some sense". That is, if I want to go to www.example.com, and I get an A record for www.example.com, and I get a TLSA record for _http._tcp.www.example.com, and I get a certificate that says "this key is associated with www.somethingelse.com", what does it mean?
>
> I can see both ways: "it doesn't matter what the cert says, we are trusting the binding from the DNS" vs. "the cert needs to mean something"? Jakob and I have that text in because a number of people on the list were in the latter category, but it seems like a reasonable question to ask separately.

This is exactly why bare public keys are good for those who do not wish to deal with
a CA or making up arbitrary CN= entries in certificates only used to contain a public
key verified by DNS.

In fact, if forced to use a cert container, I would use a self signed *.xelerance.com,
but I definitely not add a *.xelerance.com wildcard in DNS.

Demanding information that will be filled in with bogus or unvalidatable information
makes no sense from a security point of view.

Paul