Re: [pkix] Looking for some clarification on how to correctly specify rfc822Name constraint for an X.509 certificate

["martijn.list" <[e-mail]>]

Since I did not get any response, I guess my question was not clear or I
should ask somewhere else. Any idea where to ask for some clarification
on rfc822Name constraints (see below).

Kind regards,

Martijn Brinkers


On 08/17/2014 03:04 PM, martijn.list wrote:
> Recently we noticed that an end user S/MIME certificate was not
> validated by our encryption gateway. The certificate in question was
> issued by an intermediate certificate (which was again issued by a
> Quovadis root) that contained an rfc822Name constraint. The rfc822Name
> constraint was specified as follows:
> 
> @example.com
> 
> RFC 5280 specifies the format for rfc822Name constraints as follows:
> 
> "A name constraint for Internet mail addresses MAY specify a
> particular mailbox, all addresses at a particular host, or all
> mailboxes in a domain.  To indicate a particular mailbox, the
> constraint is the complete mail address.  For example,
> "[e-mail]" indicates the root mailbox on the host
> "example.com".  To indicate all Internet mail addresses on a
> particular host, the constraint is specified as the host name.  For
> example, the constraint "example.com" is satisfied by any mail
> address at the host "example.com".  To specify any address within a
> domain, the constraint is specified with a leading period (as with
> URIs).  For example, ".example.com" indicates all the Internet mail
> addresses in the domain "example.com", but not Internet mail
> addresses on the host "example.com"."
> 
> (http://tools.ietf.org/html/rfc5280#section-4.2.1.10)
> 
> So the way I read this is that a constraint for the domain example.com
> should be specified as
> 
> example.com
> 
> and not as
> 
> @example.com
> 
> This might explain why our Java based software refuses to validate the
> end user certificate since [e-mail] does not match the
> @example.com constraint. Adding an @ symbol will also be problematic
> when using the .example.com domain constraint since that would then
> result in @.example.com.
> 
> To confuse things even more, Microsoft seems to mix the two options.
> They use @example.com for constraining to the example.com domain but
> .example.com for matching sub domains:
> 
> "UPN name constraints should always be entered as two separate entries
> in the list of name constraints. One entry should include the ampersand
> character (such as @nwtraders.com); the second entry should replace the
> ampersand with a period (.), so this entry would be .nwtraders.com. This
> format allows for the possibility of having a UPN of
> subdomain.nwtraders.msft."
> 
>>From http://technet.microsoft.com/en-us/library/cc737026%28v=ws.10%29.aspx
> 
> Is there any consensus on what the correct format is according to RFC 5280?
> 
> Are there other implementations that use @example.com instead of
> example.com for rfc822Name constraints?
> 
> Kind regards,
> 
> Martijn Brinkers
> 
> 


-- 
CipherMail email encryption

Open source email encryption gateway with support for S/MIME, OpenPGP
and PDF messaging.

http://www.ciphermail.com

Twitter: http://twitter.com/CipherMail