Subject: RE: Correct approach to certificate validation?

From: "Grant, Alistair" <[email-masked]>
Date: Fri, 9 Jun 2000 13:57:51 +1000

Hi Trevor,

Trevor Freeman wrote:
> To err is human, and people make mistakes.
 
Which is one of the reasons why a certificate may be revoked and re-issued.
 
To add to the list of arguments for following the standard:
 
Inconsistent behaviour amongst various components of a system simply makes
tracking down a problem more difficult, as I expect Denis Bider can attest
to.  I doubt that this change has made the overall system more robust.  It
seems unlikely that all implementations are going to operate in the same
manner.  Based on Denis' experience, just taking Microsoft's various systems
results in inconsistent behaviour.

Cheers, 

Alistair Grant 
Project Manager - Development 
Computer Associates, OpenDirectory Lab 
Mooroolbark, Victoria, Australia 
Phone:    +61 3 9727 8912 
Mobile:   +61 408 565 080 
Fax:      +61 3 9727 3491 
E-Mail:   [email-masked]

---

From: <[email-masked]>
Date: Fri, 9 Jun 2000 14:05:08 +0200

> Inconsistent behaviour amongst various components of a system simply
> makes tracking down a problem more difficult, as I expect Denis Bider
> can attest to.

Grant is correct on this issue. As a user/developer, I would have preferred
IE5 and Outlook to use the same validation scheme as is used in other
products out there.

(Simple example: if IE5/Outlook2000 did use the same validation technique as
the rest of the world, I would not have been misled into thinking that the
problem is at the IIS side, and, hence, would not have spent tens of hours
trying to find the problem where it did not exist. Of course, it was my
mistake that caused certificate names not to chain, and nor IE5 nor IIS can
be blamed for any of this. Essentially, the fault was mine entirely. But
still, where IE's behavior could be helpful, it was misleading. Personally,
I would have preferred it to be helpful.)

Regards,

denis