Subject: Report - certificate validation in IE5, Outlook, IIS4, Netscape 4.72

From: <[email-masked]>
Date: Sun, 4 Jun 2000 20:08:21 +0200

Hello,

a while ago I sent to this list an enquiry regarding Microsoft's certificate
validation code in IIS4. I have now resolved the problem that was the reason
for my enquiry. Since the solution to the problem produced some interesting
insight into how certificate chains are handled in IE5 and Outlook / IIS4
and Netscape, and since the behavior in question should be covered by
RFC2459, but does not seem to be, I am forwarding my findings to you.

I produced my own certificate generating utility, the intention of which was
to generate certificates which could be used by IE5 to login into an
SSL-protected web site running on IIS4. My problem was that, although IE5
claimed my root-cert/subject-cert certificate chain to be valid, and
although Outlook properly signed and verified messages signed by these
certificates, IIS4 rejected all attempts to use the subject certificate for
SSL client authentication. Also, when the subject certificate was imported
into Netscape, Netscape didn't even show it as an elligible choice for SSL
client authentication.

To sum it up, the problem was that there was a glitch in my code that caused
the subject-DN in root-cert to be slightly different from the issuer-DN in
the subject-cert. It seems that the certificate verification code in IE5 and
Outlook2000 is somewhat easy-going, since both of these products validated
the pair of certificates as valid (they performed cert-chain validation
solely on the grounds of the key identifier in the Authority Key Identifier
extension, they did not compare the sub-cert-issuerDN to the
root-cert-subjectDN). IIS4 and Netscape Communicator, on the other hand,
seem to have a more stringent policy, since they both rejected these
certificates.

denis bider

---

From: Russ Housley <[email-masked]>
Date: Mon, 05 Jun 2000 13:09:05 -0400

Denis:

I do not belive that RFC 2459 is silent on this subject.  See 6.1, path 
processing action (a) (4).

Russ