RE: New Liaison Statement, "Liaison to IETF on the resolution of DR320"

[Paul Hoffman <[e-mail]>]

At 12:37 PM -0400 10/19/07, Tom Gindin wrote:
>         I know this response is a little late, but the main reason that
>there is no central repository for CA names is that there is no world-wide
>directory using X.500 names.

While the latter is obviously true, it is not the "main reason". The 
"main reason" is that many (most?) CAs could get no real value out of 
a "world-wide directory using X.500 names". For example, when an 
organization becomes a CA by making its own trust anchor for internal 
use, having to register in a "world-wide directory" is  a hindrance, 
not a feature.

>For reasons which have been discussed many
>times on this list, there probably never will be.

"Probably" may be understating the likelihood.

>Of course,  the IETF
>knows of an existing registry which could be used to avoid conflicts
>between CA names.

We do?

>         How about the following wording: "Certificate Authorities SHOULD
>NOT use a value in the Organization or Common Name attribute of their
>Distinguished Name which is syntactically legal as a dNSName (i.e. an IA5
>string containing one or more periods but no spaces) unless they are
>operated by an organization which has registered the domain name
>controlling that dNSName.  Certificate Authorities wishing to ensure a
>globally unique issuer name MAY use an IA5 FQDN controlled by their
>organization in either the Organization or the Common Name attribute."

This might be appropriate in an ITU document, but is it really 
appropriate for a standards-track IETF document? In specific, the 
latter makes it sound like using your domain name is safe. Might be, 
might not be.

>Does anybody want to add Organizational Unit into the mix, and possibly
>even make it a SHOULD for newly allocated CA's?

I don't see how this would help. If you look at the OUs in 
IssuerNames of certificates flying around the net, you can see that 
few people understand OUs,

>         Given my unfamiliarity with non-alphabetic scripts, I hesitate to
>discuss internationalized DNS names in this connection unless Punycode is
>relevant.  However, even without considering DR 320, using somebody else's
>domain name as your CN or O attribute is misleading.

True, but I do not think that it is the place of IETF documents to 
say what is or is not "misleading".

--Paul Hoffman, Director
--VPN Consortium