Subject: Re: Looking for Standards

From: [email-masked] (Peter Gutmann)
Date: Wed, 14 Feb 2001 06:30:13 (NZDT)

Lars Pfuhl <[email-masked]> writes:

>I'm looking for some standards (RFCs) dealing with certificate management over
>http. The standard must describe how to store and to get certificates from a
>certificate server. I've only found the rfc for OCSP (rfc 2560) but it
>contains only the standards for checking the status of a certificate. If you
>have a hint for me which rfc is the right it would be very nice.

There's no standard for this, but I've come across a number of people/
organisations who have invented their own methods for it (it's so simple that
there's not much to it, however Sod's law results in everyone choosing not-
quite-the-same way to do the same thing).  I created a sketch of this a while
back for a company who were setting up a national cert database here, I could
turn this into an RFC draft fairly easily if there's any interest, mostly to
provide some sort of common ground for implementors.

Peter.

---

From: Polar Humenn <[email-masked]>
Date: Tue, 13 Feb 2001 17:40:46 -0500 (EST)

There is a standard for certificate management out of the CORBA E-commerce
Group, from the OMG (Object Management Group), the standards group for
Object Request Brokers.

The document number there is: 
	http://cgi.omg.org/cgi-bin/doc?ec/99-12-03

Cheers,
-Polar

> provide some sort of common ground for implementors.

-------------------------------------------------------------------
Polar Humenn                  Adiron, LLC
mailto:[email-masked]       2-212 CST      
Phone: 315-443-3171           Syracuse, NY 13244-4100
Fax:   315-443-4745           http://www.adiron.com

---

From: Michael Ströder <[email-masked]>
Date: Wed, 14 Feb 2001 17:26:22 +0100

>         http://cgi.omg.org/cgi-bin/doc?ec/99-12-03

Document ec/99-12-03 (DSTC Revised Submission against the PKI RFP)
                                              ^^^^^^^^^^^^^^^^^^^
How to understand this?

Ciao, Michael.

---

From: Polar Humenn <[email-masked]>
Date: Wed, 14 Feb 2001 12:25:17 -0500 (EST)

> Document ec/99-12-03 (DSTC Revised Submission against the PKI RFP)

I wish I knew why this strange terminology is used in places. It throws me
as well.

It means that the "Submission", which is the actual proposal, is *for* the
particular (RFP) Request For Proposal, in this case the Public Key
Infrastructure (PKI) RFP.

I think it's just a result years of nicknames and phrases that caught on.
Richard, Andrew, please correct me if I'm wrong.

Cheer,
-Polar