Subject: RE: Certificates, Directories, and Distinguished Names

From: Alan Lloyd <[email-masked]>
Date: Mon, 5 Apr 1999 09:03:56 +1000

Thanks for that steve. I understand DNS names - I have a few :-)

Its just that using this form of address (DNS) - just makes the PKI / CA
concerned very limited (operationally) and bespoke. ie. one cannot ring
the subject up in the event of errors - nor can one tie business rules
or other info to them (as one can do with a directory service based
system), one also must  supply the EE cert with the transaction as one
could scan the whole directory searching for dns type attrs.. small
issues..

My question was really aimed at the cert extensions subject - issuer alt
names.. I still dont understand what and why these are in the cert - if
its baggage for some obscure reason - then thats OK - but if its for
validation process issues - then they have to be spelled out. And if
they are just baggage, instead of making them  "alt name forms"- why not
call then subject and issuer additional info or in fact just make them
cert ext directory attributes?

We seem to have in these extensions, a lot of form without content.

regards alan

----------
From: Stephen Kent
To: Alan Lloyd
Cc: 'Bob Jueneman '; [email-masked] '; [email-masked] ';
[email-masked] '
Sent: 3/30/99 6:24:18 AM
Subject: RE: Certificates, Directories, and Distinguished Names

Alan,

>I am not to sure what going to a DNS based name does does in terms of
>process - eg. validation process or things that use certificates - can
>someone please enlighten me.

DNS names are often native to the applications, e.g., IPsec, SSL/TLS,
and
S/MIME, and thus it is preferable to make use of them as a more direct
input to an access control decision.  For example, browsers using SSL
usually match the URL against a DNS name crudely encoded as a common
name.
It would be preferable (as 2459 points out) if the encoding were direct,
rather than kludged in this fashion.  Also, there are standards for
storing
certs in the DNS, which might allow one to take advantage of a very
large,
deployed repository infrastructure in the Internet.

>ie. if there are problems with Issuer DN (ie its an SMTP address in the
>extensions) and I am in the process of path validation - do I mail the
>Issuer with something?

That's not the motivation for use of DNS names here.

>What about CRLs - are they attached to these DNS indexed things.

Yes, there are provisions for storing CRLs, as well as certs, in DNS.

>I understand that AIAs are useful as they deal with explicit a cert
>based function such as OCSP.
>I just dont understand the process (that must be related to the
>certficate) if DNS type names are used for issuers, etc.

If a DNS name is used exclusively, we restrict it to the subject field
for
an end entity certificate.  Otherwise a DN must be present in the Issuer
and/or Subject fields.

>In addition - if one mixed name forms in a cert path - the process
rules
>can get messy. eg mail here, ldap there, OCSP over there, etc

As noted above, the simple case is to use DNS names only for end
entities.

Steve

---

From: Stephen Kent <[email-masked]>
Date: Mon, 5 Apr 1999 13:49:03 -0400

Alan,

>We seem to have in these extensions, a lot of form without content.

Alt names allow a PKI to use name forms most closely aligned to the
application context with which the certs will be used. That, by itself, is
sufficient reason to provide them.  Look at the messes created by shoe
horning DNS names into DNs in SSL certs, or e-mail addresses into DNs in
S/MIME.  We can't go back and change the Subject and Issuer to be
GeneralNames due to backward compatability constraints, so ...

Steve