Re: [pkix] purpose of LDAP in PKI

When an enterprise is issuing certificates to its employees and 
contractors there can be a need to make the encryption certificate 
publicly available for traffic from external parties to individuals at 
that enterprise.

Joel

On 2/18/2013 9:08 AM, Goulet, Walter wrote:
> Quoting Peter Gutmann <pgut001@cs.auckland.ac.nz>:
> Andris Berzins <pkix@inbox.lv> writes:
>
>>>> What could be the reason why end user certificates should be stored in LDAP
>>>> by the CA and made publicly available?
>>> There isn't one. It's (ancient) historical baggage based on X.509's origins
>>> in X.500, and some of the people writing the standards haven't realised yet
>>> that HTTP won.
>
>> When I apply for ID-card having authentication and qualified signature certificate on it,
>> I have to checkbox whether I want my certificates to be published in LDAP.
>> I get no clear answer how could I benefit from my certificates being published.
> In enterprise or other private PKI deployments publishing certificates to LDAP stores can be very useful for applications such as S/MIME where a sender's mail client can fetch a recipient's certificate from a centralized LDAP directory service. Basically, exposing your certificate via LDAP makes it *much* easier for other applications to actually use your certificate.
>
> The benefits of publishing your certificate publicly (i.e. over Internet accessible LDAP directory store) are less clear to me.
>
>
> Peter.
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>
>   
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix