Subject: Standard for Name Constraints for X500Names

From: Anne Anderson <[email-masked]>
Date: Fri, 30 Aug 2002 14:12:34 -0400 (EDT)

In RFC3280, I do not find an algorithm or reference for how
X500Name NameConstraints are compared.  I know that the empty
string is the root of the X500 name space, but..

If A is constrained by B,
- must A include all RDNs in B as its most general RDNs?
- is there any sub-matching within a given RDN?  e.g.
   CN="* Anderson" matching "CN="Anne Anderson", or some other
   syntax for such partial matches?

Is there a standard for such comparisons?  An X500 ordering-rule
or something?

Anne Anderson
-- 
Anne H. Anderson             Email: [email-masked]
Sun Microsystems Laboratories
1 Network Drive,UBUR02-311     Tel: 781/442-0928
Burlington, MA 01803-0902 USA  Fax: 781/442-1692