Re: [pkix] Looking for some clarification on how to correctly specify rfc822Name constraint for an X.509 certificate

[Erwann Abalea <[e-mail]>]

In my view, there's no confusion in RFC5280. "@" is not required/accepted
in a rfc822Name element.
The fact that Microsoft choses another format for otherName:UPN does not
change the rfc822Name semantics (while validating against NameConstraints).

2014-08-22 10:08 GMT+02:00 martijn.list <[e-mail]>:

> Since I did not get any response, I guess my question was not clear or I
> should ask somewhere else. Any idea where to ask for some clarification
> on rfc822Name constraints (see below).
>
> Kind regards,
>
> Martijn Brinkers
>
>
> On 08/17/2014 03:04 PM, martijn.list wrote:
> > Recently we noticed that an end user S/MIME certificate was not
> > validated by our encryption gateway. The certificate in question was
> > issued by an intermediate certificate (which was again issued by a
> > Quovadis root) that contained an rfc822Name constraint. The rfc822Name
> > constraint was specified as follows:
> >
> > @example.com
> >
> > RFC 5280 specifies the format for rfc822Name constraints as follows:
> >
> > "A name constraint for Internet mail addresses MAY specify a
> > particular mailbox, all addresses at a particular host, or all
> > mailboxes in a domain.  To indicate a particular mailbox, the
> > constraint is the complete mail address.  For example,
> > "[e-mail]" indicates the root mailbox on the host
> > "example.com".  To indicate all Internet mail addresses on a
> > particular host, the constraint is specified as the host name.  For
> > example, the constraint "example.com" is satisfied by any mail
> > address at the host "example.com".  To specify any address within a
> > domain, the constraint is specified with a leading period (as with
> > URIs).  For example, ".example.com" indicates all the Internet mail
> > addresses in the domain "example.com", but not Internet mail
> > addresses on the host "example.com"."
> >
> > (http://tools.ietf.org/html/rfc5280#section-4.2.1.10)
> >
> > So the way I read this is that a constraint for the domain example.com
> > should be specified as
> >
> > example.com
> >
> > and not as
> >
> > @example.com
> >
> > This might explain why our Java based software refuses to validate the
> > end user certificate since [e-mail] does not match the
> > @example.com constraint. Adding an @ symbol will also be problematic
> > when using the .example.com domain constraint since that would then
> > result in @.example.com.
> >
> > To confuse things even more, Microsoft seems to mix the two options.
> > They use @example.com for constraining to the example.com domain but
> > .example.com for matching sub domains:
> >
> > "UPN name constraints should always be entered as two separate entries
> > in the list of name constraints. One entry should include the ampersand
> > character (such as @nwtraders.com); the second entry should replace the
> > ampersand with a period (.), so this entry would be .nwtraders.com. This
> > format allows for the possibility of having a UPN of
> > subdomain.nwtraders.msft."
> >
> >>From
> http://technet.microsoft.com/en-us/library/cc737026%28v=ws.10%29.aspx
> >
> > Is there any consensus on what the correct format is according to RFC
> 5280?
> >
> > Are there other implementations that use @example.com instead of
> > example.com for rfc822Name constraints?
>

-- 
Erwann.