Subject: Re: Acceptance of DC-style DNs (was: OCSP I-Ds going forward)

From: [email-masked] (Peter Gutmann)
Date: Sat, 30 Nov 2002 15:03:31 +1300 (NZDT)

David Chadwick <[email-masked]> writes:

>This is completely the opposite of my experience from giving public PKI and
>LDAP courses in London. People immediately see the benefit of leveraging the
>DNS name registration scheme to give them globally unique X500/LDAP DNs

It may be a cultural thing.  The person I mentioned who'd had OSI experience
was from the UK, and his reaction to DCs was (uhh, without trying to pick on
people from there :-) "This was the sort of thing they were doing there when I
left" (he may have used a word other than "thing" in the sentence).

Without wanting to get into a long debate on this, the existence of one or two
certs with DCs doesn't indicate their general acceptance (for example your
cert is one produced by your own CA!).  I have a whole pile of certs with
various oddities in them (I have one from my CA with a cat MPEG), none of
which are in widespead use.

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Sat, 30 Nov 2002 15:20:25 +0100

Peter Gutmann wrote:
> certs with DCs doesn't indicate their general acceptance

Without defining what "general acceptance" is we can't tell whether DC-style 
DNs are generally accepted or not. I guess we won't agree on a definition 
therefore it's worthless debating it at all.

In practice when deploying PKI with some sort of certificate profile you 
generally have to check whether all the components you're gonna use will 
handle these certificates correctly (without crashing, etc.). Looking at 
discussions here I doubt that the on-going "standardization" efforts of PKIX 
will significantly change this situation.

> (for example your cert is one produced by your own CA!).

So what?

Ciao, Michael.