Re: [pkix] purpose of LDAP in PKI

Quoting Peter Gutmann <pgut001@cs.auckland.ac.nz>:
Andris Berzins <pkix@inbox.lv> writes:

>>>What could be the reason why end user certificates should be stored in LDAP
>>>by the CA and made publicly available?

>>There isn't one. It's (ancient) historical baggage based on X.509's origins
>>in X.500, and some of the people writing the standards haven't realised yet
>>that HTTP won.

>When I apply for ID-card having authentication and qualified signature certificate on it,
>I have to checkbox whether I want my certificates to be published in LDAP.
>I get no clear answer how could I benefit from my certificates being published.

In enterprise or other private PKI deployments publishing certificates to LDAP stores can be very useful for applications such as S/MIME where a sender's mail client can fetch a recipient's certificate from a centralized LDAP directory service. Basically, exposing your certificate via LDAP makes it *much* easier for other applications to actually use your certificate.

The benefits of publishing your certificate publicly (i.e. over Internet accessible LDAP directory store) are less clear to me. 

Peter.
_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix