Subject: (OT?) ambiguities with printable distinguished names

From: Martin Rex <[email-masked]>
Date: Thu, 25 Sep 2003 22:49:07 +0200 (MET DST)

I'm sorry if my message is a slightly off-topic for Kerberos.
If I get private replies and receive interesting information
to share then I'll post a summary to the list to keep the
OT-discussion low.

I just have resolved a customer problem about how to write
a "State-or-Province" attribute in a distinguished name with
our software.  Unfortunately our PKI/SSL software (it's an OEM software)
uses a non-standard "SP=" labeling and the Microsoft IE 5.5 certificate
visualization popup seems to use yet another non-standard "S=",
whereas X.520 and LDAP (rfc2253) specify "ST=".

The well-known X.520 attributes seem to be:
 Common Name          OID  2.5.4.cn(3)
 Surname              OID  2.5.4.sn(4)
 Serial Number        OID  2.5.4.serialNumber(5)
 Country              OID  2.5.4.c(6)
 Locality             OID  2.5.4.l(7)
 State or Province    OID  2.5.4.st(8)
 Street               OID  2.5.4.street(9)
 Organization         OID  2.5.4.o(10)
 Organizational Unit  OID  2.5.4.ou(11)
 Title                OID  2.5.4.title(12)
 Description          OID  2.5.4.description(13)
 Business Category    OID  2.5.4.businessCategory(15)

rfc2253 lacks sn,serialNumber,title,description and businessCategory,
but lists domainComponent and userid (unfortunately all without OIDs...).

There's not problem with the binary ASN.1 DER encoding, but as
soon as an Admin has to type the printable into an UI
(or copy&paste the printable between two UIs of different
vendors), there could be a problem.

This makes me wonder what Microsoft uses for their LDAP-
and Certificate-Server related UIs and whether such subtle
details may be a source of confusion of future users
of PKINIT-enabled Kerberos software...

-Martin