[keyassure] The draft and subj alt names

["Olle E. Johansson" <[e-mail]>]

I have read the draft and reacted to one thing. Sorry if this already have been discussed on the list.

The draft -06 says
"The end entity certificate from TLS, regardless of whether it was
   matched with a TLSA type 1 certificate or chained to a TLSA type 2 CA
   certificate, must have at least one identifier in the subject or
   subjectAltName field of the matched certificates matches the expected
   identifier for the TLS server. "

The new RFC 6125 tells us that we should:
"Move toward including and checking even more specific
      subjectAlternativeName extensions where appropriate for using the
      protocol (e.g., uniformResourceIdentifier and the otherName form
      SRVName)."

I feel we need to be more specific in the draft.  What type of subjectAltName should we match with?
dnsName?

And if we're using SIP, and have URI's in the certificate - should that be part of this draft
or should we open for protocol-specific specifications for other types of subject Alt Names?

/O