Re: [saag] ASN.1 vs. DER Encoding

[Nico Williams <[e-mail]>]

On Tue, Apr 23, 2019 at 11:08:23AM -0400, Michael Richardson wrote:
>     >> X.500 one are used in certificates.  I strongly encourage people to
>     >> keep it simple.  The bits on the wire sitll get too complicated, but
>     >> the code can mostly do exact match processing.
> 
>     > To keep it simple means to leave the subjectName empty and use dNSName
>     > and rfc822Name SANs instead wherever possible.
> 
> Yes, but we can't leave the IssuerDN empty, and if we want chains of
> certificates (we do), then we need to put something into the subjectDN.

Well, there is id-ce-issuerAltName, but indeed, the issuer Name must not
be empty.  At least we can encode domainnames as DNs, and there's no
need to represent, e.g., email addresses as issuer DNs.

In any case, issuer names don't leak as much into UIs, so it's less
critical that we use dNSName SANs for them.