Re: [keyassure] The draft and subj alt names

[Paul Wouters <[e-mail]>]

On Fri, 1 Apr 2011, Jay Daley wrote:

>> As I've said in other threads, this WG should be silent on requirements for certificate names, since different applications use TLS certificate names in different ways.  See for example the difference between RFC 2818 and RFC 6125.  The text you reference in the draft is technically harmless ("must" not "MUST"), but should probably be deleted anyway.
>
> There are two separate issues here:
> a) whether we think name matching is still needed with DANE
> b) what the draft should say about that
>
> On a) I would make the case that name matching is should not be done because
> - DNSSEC provides sufficient trust
> - name matching forces certain operational decisions onto end user (e.g. multiple certs, cert reuse) that are unreasonable

Also, image you have to keep updating your cert in DANE every time you add/remove a
vhost and you have to update the subjectAltname. One of the advantages of putting it
in DNS is that you know the name of the entity without having to look inside the cert.

The cert is just a legacy container for the public key. We should not be adding policy
in DANE that entangles DANE with PKIX (or any other trust scheme)

Paul