Subject: bounding NameConstraints

From: Anne Anderson - Sun Microsystems <[email-masked]>
Date: Wed, 23 Jun 1999 14:22:30 -0400 (EDT)

I would like to be able to set NameConstraints such that ONLY
specified name types are accepted for subsequent end-entity
certificates. I can do this by creating a
NameConstraints:permitted:<type>:null entry for all those types I do
not wish to allow.

The problem is that I would also like to prohibit all certification
paths that use any OtherName types as well.  Otherwise, one of the
CA's may start issuing certificates for identities I don't want to
accept using a newly defined OtherName type.

Is there any way to specify "permitted:none" for ALL OtherName
types?

Anne Anderson
-- 
Anne H. Anderson  ECI#712-KC Email: [email-masked]
Sun Microsystems Laboratories   or: [email-masked]
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692