Subject: HTTP over TLS: dNSName syntax question

From: "william bamberg" <[email-masked]>
Date: Fri, 9 Jun 2000 17:00:53 +0100

Sorry if this is marginally off topic, but I'd like to know people's
opinions...

RFC 2818, 'HTTP over TLS', Section 3.1, 'Server Identity' describes how to
compare the name in the server's certificate with the server domain name:

'If a subjectAltName extension of type dNSName is present, that MUST be used
as the identity. Otherwise, the (most specific) Common Name field in the
Subject field of the certificate MUST be used...Matching is performed using
the matching rules specified by [RFC2459].'

RFC 2459 says that the dNSName 'MUST be in the "preferred name syntax," as
specified by RFC 1034.'

So, presumably the matching here is performed by comparing every subdomain
in the dNSName against the corresponding subdomain in the server's domain
name.

But RFC 2818 goes on to say that 'Names may contain the wildcard character
*'
and goes on to specify how these names should be handled.

The 'preferred name syntax' says nothing about wildcards, so my question
really is, how can the dNSName component both be represented according to
the 'preferred name syntax', and contain wildcards?

Thanks very much for any help you can offer.

Will

---

From: Stephen Kent <[email-masked]>
Date: Mon, 12 Jun 2000 17:56:30 -0400

Will,

>the 'preferred name syntax', and contain wildcards?

RFC 2459 does not allow wildcards in the dNSname attribute, as that 
would result in strings that are NOT DNS names.  The 2818 text refers 
to an historic convention employed when CAs put DNS names in the CN 
field of a DN.   In fact, the text you cite refers to this convention 
(that is disparaged in 2459).  Note the reference to "Common Name" in 
that text.  So, it seems that the 2818 text is a bit schizophrenic, 
based on what you say above.  (I have not read 2818, so I am taking 
your word for the relevant quote.)

Steve