Subject: RE: where should email address go?

From: "Harrington, Chris" <[email-masked]>
Date: Tue, 14 May 2002 09:41:57 -0400

I also thought it was the other way around. SAN gives some consistency to where the e-mail address is placed. Having the e-mail the DN can cause interop issues. We ran into a problem where some CA's placed the e-mail at the beginning of the DN (email= [email-masked] <mailto:[email-masked]>  , CN= My cert) with most placing it at the end (CN=My cert, email= [email-masked] <mailto:[email-masked]> ). This can cause issues when you try to look up a certificate in a directory or enumerate them from a certificate store.

Cheers,

Chris

-----Original Message----- 
From: Dean Adams [mailto:[email-masked]] 
Sent: Tue 5/14/2002 4:06 AM 
To: Mike Rowan; 'Richard Culshaw '; 'Ietf-Pkix (E-mail) ' 
Cc: 
Subject: RE: where should email address go?

	Hi,
	        Er - it was my understanding that it was actually the other way around,
	i.e. legacy apps may continue to place email addresses in the Subject DN,
	but that new apps are encouraged to use subjectAltName.
	
	For instance RFC2632 (S/MIME v3 certificate handling) states:
	End-entity certificates MAY contain an Internet mail address as described in
	[RFC-822]. The address must be an "addr-spec" as defined in Section 6.1 of
	that specification.  The email address SHOULD be in the subjectAltName
	extension, and SHOULD NOT be in the subject distinguished name.
	
	I believe, (though cannot find the reference at the moment) that Microsoft
	email apps (surely these being reasonably prevalent leagacy apps) have
	documented their position as previously using Subject DN for email
	addresses, but that they now recommend subjectAltName, and have stated that
	support for email addresses Subject DN in some future version may be
	dropped.
	
	        Dean
	
	____________________________________________________________
	Dean Adams               mobile:         +44 (0)7989 385914
	Trustis Limited          Direct Tel/Fax: +44 (0)1252 734320
	49 Whitehall             Office Tel:     +44 (0)20 7451 1490
	London SW1A 2BX          Office Fax:     +44 (0)20 7484 7961
	email: [email-masked]    Web: http://www.trustis.com
	____________________________________________________________
	The information in this message is confidential.  It is intended solely for
	the addressee.  Access to this message by anyone else is unauthorised.  If
	you are not the intended recipient, any disclosure, copying, distribution or
	any action taken or omitted to be taken in reliance on it, is prohibited and
	may be unlawful.
	
	Any attachments to this message have been checked for viruses, but please
	rely on your own virus checker and procedures.
	
	If you contact us by e-mail, we may store your name and address to
	facilitate communications.

	> -----Original Message-----
	> From: [email-masked]
	> [mailto:[email-masked]]On Behalf Of Mike Rowan
	> Sent: 14 May 2002 06:13
	> To: 'Richard Culshaw '; 'Ietf-Pkix (E-mail) '
	> Subject: RE: where should email address go?
	>
	>
	>
	> Richard:
	>
	> You are correct in that only some legacy apps use the RFC822Name
	> in the SAN.
	> Your best bet is to place this in both Subject DN and the SAN, unless of
	> cource you can be sure of your application usage.  Still it would be
	> limiting, by placing this in both you are sure to meet most needs.  There
	> may be a possiblity of a partiular legacy app having issues with
	> SAN values,
	> although I have not seen this as of yet.
	>
	> - Michael Rowan
	>   GeoTrust, Inc.
	>
	> -----Original Message-----
	> From: Richard Culshaw
	> To: Ietf-Pkix (E-mail)
	> Sent: 5/13/02 10:56 PM
	> Subject: where should email address go?
	>
	>
	>
	> Hi all,
	>
	> a quick question for the group...
	>
	> what is the best place to put an email address value in an client
	> certificate
	> in the E field of the Subject DN eg:
	> E = [email-masked]
	>
	> or
	> in the Subject Alt Name Extenstion eg:
	> RFC822 Name=[email-masked]
	>
	> my understanding is that only some legacy applications use the Subject
	> Alt
	> Name extension and just about all the client software out there looks in
	> the
	> Subject DN for the email address?
	>
	>  what about placing it in both fields???
	>
	> thanks in advance....
	>
	>
	>
	>
	> Richard Culshaw
	>