Subject: Re: [certid] BCP on SSL/TLS certificates

From: Dan Winship <[email-masked]>
Date: Mon, 03 May 2010 17:03:12 -0400

The ordering rules in 3.2 contain a paradox:

   o  Reference identifiers that include the source domain MUST be
      preferred over reference identifiers that include a target domain
      (if any).

   ...

   o  A reference identifier of type CN-ID (if included) MUST always be
      the lowest-priority reference identifier in the list.

So in the example given, the CN-ID MUST be 3rd by the former rule, and
MUST be 5th by latter rule.

-- Dan

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 03 May 2010 15:16:31 -0600

> MUST be 5th by latter rule.

Good point. We'll fix that in the next version (probably by saying that,
notwithstanding all other ordering rules, a CN-ID must never be ranked
higher than any other identifier type).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/