Re: [TLS] Certificate validation can of worms

[Santosh Chokhani <[e-mail]>]

Nico,

As far as CN is concerned, assuming that the path validation engine resides in a lower layer in the software stack and services a variety of protocols and applications, it would not make sense for RFC 5280 to specify this.  But, in order to facilitate what you are saying, I am an advocate of outputting the state of the name constraints as part of Section 6.1.6 of RFC 5280.  This would consist of permitted subtrees sets and excluded subtrees sets.  This output will allow higher layer protocols and applications to perform name constraints on CN.  For example, S/MIME application can verify if the e-mail address in the CN passes name constraints.

By your second part, I assume you mean when the DN contains domainComponnent attributes.  Section 4.1.2.4 of 5280 says these are not required to be converted to DNS names.  Thus, one need not apply DNS based name constraints to such DN.  I can see when the DN has a mix of attributes this leading to problems.  It is better to provide guidance to the CAs to assert the corresponding names as DNS name as well.  BTW, anything one does in this area should be applied uniformly to the Subject DN or DN in SAN.  I also did not see the discussion of this in RFC 6125.  May be I missed it or you meant something else altogether.

-----Original Message-----
From: Nico Williams [mailto:[e-mail]] 
Sent: Tuesday, April 08, 2014 3:07 PM
To: Santosh Chokhani
Cc: [e-mail]; [e-mail]
Subject: Re: [TLS] Certificate validation can of worms

On Tue, Apr 8, 2014 at 1:40 PM, Santosh Chokhani <[e-mail]> wrote:

I agree with what you say, but there is one area where I think name constraints could be improved: when a certificate has no subjectAlternativeNames, or only directoryNames when it does, and those names are RFC6125-style, then if the CA certs in the validation path have dNSName name constraints then those should be applied to the CN RDNs of the subjectName and/or dirname SANs that bear the domainnames.  To my knowledge this isn't codified, but correct me if I'm wrong.

Nico
--