Subject: Re: UI DN as certificate subject was RE: Straw Poll: SerialNumber definition

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 1 Mar 2000 20:54:38 -0000

Robert, 
May I put my personal view on this matter. 
As far as I can see there is no real standard for how you utilize DNs. 
Some comments in line. 

-----Original Message-----
From: Robert Malick <[email-masked]>
To: [email-masked] <[email-masked]>
Date: Tuesday, February 29, 2000 20:02
Subject: UI DN as certificate subject was RE: Straw Poll: SerialNumber definition

>
>It seems in the discussion of placing the uniquely identifiying DN in the
>SubjectAltName everyone is assuming that one needs something other than
>that as the certificate subject.
>
>Is it totally illegal or just not good practice for some reason to have a
>uniquely identifying DN as a certificate subject and have the application
>find other commentary attributes like displayable name (e.g., cn)
>by accessing the entry in the directory for that subject DN? 

Probably not illegal (I am not an X500 lawyer) but the practice seems to be to use 
subject DNs as placeholders for various subject-related data. That was my reason for 
adding an extension to aid the interpretation (if the RP wants that) of unmistakable 
identities as well as display data.

>For example,
>
>Certificate Subject: sn=0001000018, o=acme, c=us
>
>An application when looking up that DN in the directory will find:
>
>dn: sn=0001000018, o=acme, c=us
>cn: Joe Smith
>...

I have some comments to this. 

1. If the cert is going places outside of its original domain it seems less useful without 
the name of the subject as the CA may well be trusted but SN may not say that much (except 
working in conjunction with the other attributes as a perfect unmistakable identity) 

2. Commercial SW displaying certificates work better if they get a CN which seems 
to be the lowest common denominator.  IE 4.0 presents my Swedish ID-cert as
two vertical bars only (!!) while IE 5.0 says “Rundgren” but it should have said
"Anders Rundgren" which is my common name.  That is where you land if you
read the X50.9 standard too literally and forget about programs that can’t guess
that great.  Steve, are you listening? :-) :-)

3. Talking about unmistakable identities: If the anticipated CAs domain is US, I would 
say that C=US is redundant. But C is common practice regardless if it is required or not. 

>The application can display what it likes of this particular certificate
>identity. Most likely the application will access the directory for other
>things for certificate path processing so I don't see this as anything out
>of the ordinary.
> 

For local apps this works fine, for standard SW this is not too common. 

>Also, this allows one to assign identity without the overhead of
>revoking certificates if these commentary attributes should change (e.g.,
>cn).
>
>Can someone tell me why it seems that one should assume that commentary
>attributes must be in the subject DN of the certificate?

This is a sensitive issue. MY opinion is that X509.v3 is a smorgasbord of 
structures that looks like a real committee product. I.e. everybody tried to fit in 
their favorites.   As a true X500 heretic I believe that 
DNs will continue to be a place to stuff of different weight and use as other 
solutions require a change in practice.   New conventions as some propose
will just make things even worse!

Anders

> Robert Malick
> National Institutes of Health
>