Subject: RE: Qualified Certificates and the 43:d IETF Meeting

From: Hans Nilsson <[email-masked]>
Date: Fri, 11 Dec 1998 10:07:19 +0100

David: 

In Sweden we originally specified the usage of uniqueIdentifier as the place
to put a "distinguisher", but we found out that no existing products could
display it (and other BIT STRINGS) properly, and might even crash, so that
is why we switched to Serial Number. 

Russ: Where and how is dnQualifier specified?

Regards
Hans

-----Original Message-----
From: david chadwick [mailto:[email-masked]]
Sent: Thursday, December 10, 1998 7:04 PM
To: Russ Housley
Cc: Stefan Santesson; secstan; [email-masked]
Subject: Re: Qualified Certificates and the 43:d IETF Meeting

Russ Housley wrote:

> Nick & Stefan:
>
> >>2)The standard attribute dnQualifier could be used instead of
serialNumber
> >>(Th attribute "serialNumber is defined in RFC 2256 as being the serial
> >>number of a device).
> >>
> >

The X.500 standard defines a uniqueIdentifier attribute that might be better
suited to the semantics than either serial number or dnQualifier.
David

>
> >Yes, the SN is not in complete harmony regarding its definition and its
> >use. However several other standardisation proposal has choosen SN for
> >personal identifiers. The rationale behind that choice have been that
most
> >applications support and displays this attribute in a correct way.
> >
> >Is there an installed base using "dnQualifier" ?
>
> We include support of dnQualifier.
>
> I strongly prefer dnQualifier over serialNumber.
>
> Russ

---

From: "Miklos, Sue A." <[email-masked]>
Date: Fri, 11 Dec 1998 09:50:48 -0500

All, 

Last March, a need was identified to disambiguate the DN of the CA to
support differentiation by domain.  In addition, a need was identified
to display the entire name to a user.

We looked at X.500 uniqueIdentifier (bitString - with no consistent
translation rules to a printable string); serviceNumber (doesn't really
work with the CA context); the RFC 1274 uniqueIdentifier (defined in '88
syntax and didn't appear to be useful if integrating LDAP) and, finally
the dNQualifer (defined as a printable string).

Based on this evaluation, we chose the DN qualifier.

If any of our assumptions were (or continue to be) incorrect and there
is an alternate solution, please let me know.

>----------
>From: 	david chadwick[SMTP:[email-masked]]
>Sent: 	Thursday, December 10, 1998 1:04 PM
>To: 	Russ Housley
>> >personal identifiers. The rationale behind that choice have been that most