Subject: Multi-valued RDNs

From: Sharon Boeyen <[email-masked]>
Date: Fri, 1 Aug 2003 11:54:03 -0400

I just want to add a little bit of what my experience with reality is. We do
have many customers who have deployed PKI with multi-valued RDNs as the
final RDN in their end-entity certificates. I'm not aware of any that have
multi-valued RDNs in the names of CAs or CRLs. The multi-valued RDNs form an
integral part of many large deployments. These naming schemes are generally
a result of the customer wanting a name scheme that is common to their
certificates and their DIT, that unambiguously identified the user with
attributes that are used in the non-electronic world, while not wanting to
necessitate a DIT that is unneccessarily deep (usually for performance
reasons). Multi-valued RDNs provide a solution for them.  I do NOT want to
debate with folks on this list whether or not they believe those are the
best name schemes. Rather I want to simply state that in my experience, many
such environments do exist. Therefore, assuming reality is important to the
discussion,  this is an important element of the standard that should be
retained.

Cheers,
Sharon

LDPsSharon Boeyen
Principal, Advanced Security
Tel: 613 270 3181
Fax: 613 270 2504 
Entrust
Securing Digital Identities
& Information
http://www.entrust.com