Subject: CMP RFC2510bis-07 implementation

From: "Frédéric Giudicelli" <[email-masked]>
Date: Tue, 8 Apr 2003 04:00:16 +0200 (CEST)

Hi,
I'm currently working on an implementation of CMP for my PKI project,
however I cam
accross a problem.
In my architecture, I try to put the Repository in the center of the PKI,
meaning
that all datas go thru the repository which will dispatch the messages to
the porper
entities.
This architecture allows me to have some redundancy, I can create many
repositories
that can synchronize between each other, plus when a CA is offline I can
connect to
the repository and export all the certificate-requests for the CA, whereas
if I
follow the PKIX architectural model (1.4), for each RA that can request
certificates
from an offline CA I will have to export the requests to a file and then
import them
to the offline CA, import the responses back to each RA, which becomes very
complicated...
In my emplementation the repository stands as a unique interface between
all entities.

My application is TCPIP client/server model, on one server I can have many
entities,
the server will then be in charge of dispatching the CMP message to the
proper
entity, identified by PKIHeader:recipient (3.1.1).
That's where my problem starts; in the case of a certificate request,
PKIHeader:recipient should contains the name of the destination entity,
which in the
PKIX implementation should be the CA name; problems in my implementation
it should
be the name of the respository (for the TCPIP server to be able to feed the
repository with the request), now if PKIHeader:recipient contains the name
of the
repository how will the repository know the destination CA ?

Maybe there should a new field in PKIHeader, such as:
- netRecipient GeneralName OPTIONAL (which identifies the intermediate
recipient,
the repository in my case)
- recipient GeneralName (which identifies the final recipient, the CA in
my case)

I hope someone will be able to solve this problem.
Thanks,
Frédéric Giudicelli
http://www.newpki.org