Subject: Re: Extension Order

From: [email-masked] (Peter Gutmann)
Date: Tue, 16 Nov 1999 11:30:52 (NZDT)

"Scott, Greg" <[email-masked]> writes:

>There's been an in house discussion re whether the extension sequence should
>have a certain order, i.e., one extension type should always proceed another,
>the extensions should appear in OID order, order of appearance doesn't matter,
>etc.
>
>It seems to me that any implementation should be able to handle extensions
>appropriately regardless of the order they appear in the cert.
>
>RFC 2459 doesn't indicate a specific order of appearance, but is anyone aware
>of an accepted order for extensions?  Has anyone experienced a fault brought
>on by the extensions of a cert appearing in a certain sequence?

I've seen them sorted as per the DER SET rules, sorted by OID, probably sorted
by functionality (extensions with related purposes grouped together), and in no
discernable order.  I'd really recommend against requiring anything beyond the
standard DER rules, it'll break large numbers of existing certs without any
real gain.

Peter.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 15 Nov 1999 22:35:23 +0000

> standard DER rules, it'll break large numbers of existing certs without any

Why does everyone think ASN.1 is so great when no-one can get it right?

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html

"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
     - Indira Gandhi