[pkix] Looking for some clarification on how to correctly specify rfc822Name constraint for an X.509 certificate

["martijn.list" <[e-mail]>]

Recently we noticed that an end user S/MIME certificate was not
validated by our encryption gateway. The certificate in question was
issued by an intermediate certificate (which was again issued by a
Quovadis root) that contained an rfc822Name constraint. The rfc822Name
constraint was specified as follows:

@example.com

RFC 5280 specifies the format for rfc822Name constraints as follows:

"A name constraint for Internet mail addresses MAY specify a
particular mailbox, all addresses at a particular host, or all
mailboxes in a domain.  To indicate a particular mailbox, the
constraint is the complete mail address.  For example,
"[e-mail]" indicates the root mailbox on the host
"example.com".  To indicate all Internet mail addresses on a
particular host, the constraint is specified as the host name.  For
example, the constraint "example.com" is satisfied by any mail
address at the host "example.com".  To specify any address within a
domain, the constraint is specified with a leading period (as with
URIs).  For example, ".example.com" indicates all the Internet mail
addresses in the domain "example.com", but not Internet mail
addresses on the host "example.com"."

(http://tools.ietf.org/html/rfc5280#section-4.2.1.10)

So the way I read this is that a constraint for the domain example.com
should be specified as

example.com

and not as

@example.com

This might explain why our Java based software refuses to validate the
end user certificate since [e-mail] does not match the
@example.com constraint. Adding an @ symbol will also be problematic
when using the .example.com domain constraint since that would then
result in @.example.com.

To confuse things even more, Microsoft seems to mix the two options.
They use @example.com for constraining to the example.com domain but
.example.com for matching sub domains:

"UPN name constraints should always be entered as two separate entries
in the list of name constraints. One entry should include the ampersand
character (such as @nwtraders.com); the second entry should replace the
ampersand with a period (.), so this entry would be .nwtraders.com. This
format allows for the possibility of having a UPN of
subdomain.nwtraders.msft."

>From http://technet.microsoft.com/en-us/library/cc737026%28v=ws.10%29.aspx

Is there any consensus on what the correct format is according to RFC 5280?

Are there other implementations that use @example.com instead of
example.com for rfc822Name constraints?

Kind regards,

Martijn Brinkers


-- 
CipherMail email encryption

Open source email encryption gateway with support for S/MIME, OpenPGP
and PDF messaging.

http://www.ciphermail.com

Twitter: http://twitter.com/CipherMail