Subject: [OT?] RFC4387 test server

From: Brad Hards <[email-masked]>
Date: Sun, 26 Mar 2006 19:23:04 +1100

[My apologies if this is Off Topic - happy to take it somewhere else if I can 
have a hint on where.]

I'm looking at implementing a client that can get X.509 certificates and PGP 
keys using some (probably not all) the RFC4397 methods. I'd prefer to make 
sure I'm interpreting things correctly by not implementing my own server if 
possible.

1. Is there a "known good" server that can be used for testing? 
2. If there is, are there certificates that match that server (i.e. have the 
accessLocation values for certs and crls set).

Brad

---

From: [email-masked] (Peter Gutmann)
Date: Sun, 26 Mar 2006 23:45:46 +1200

>accessLocation values for certs and crls set).

Request for Comments: 4397
A Lexicography for the Interpretation of Generalized Multiprotocol Label
  Switching (GMPLS) Terminology within the Context of the ITU-T's
  Automatically Switched Optical Network (ASON) Architecture

Hmm, I'm not aware of any server allowed GMPLS for certificate access.  Do you
mean 4387?

Peter.

---

From: Brad Hards <[email-masked]>
Date: Mon, 27 Mar 2006 06:44:41 +1100

On Sunday 26 March 2006 21:45 pm, Peter Gutmann wrote:
> >I'm looking at implementing a client that can get X.509 certificates and
> > PGP keys using some (probably not all) the RFC4397 methods. I'd prefer to
> > make sure I'm interpreting things correctly by not implementing my own
> > server if possible.
> >
> >2. If there is, are there certificates that match that server (i.e. have
> > the accessLocation values for certs and crls set).
>
> Hmm, I'm not aware of any server allowed GMPLS for certificate access.  Do
> you mean 4387?
Urgh. Yes - 4387, per the subject, not per the text...

Brad

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 31 Mar 2006 03:02:39 +1200

>Urgh. Yes - 4387, per the subject, not per the text...

I know of several implementations built into applications or devices, but I
don't know of any public servers that you can access for this.  OTOH since
it's just a basic HTTP fetch, you can hack something together for testing
fairly quickly - I know of one that was done in Java, and another as a PHP
script for just this purpose.  If you want a publicly-available implementation
of a server that you can run yourself, you could grab a copy of cryptlib,
http://www.cs.auckland.ac.nz/~pgut001/cryptlib/, it's not actually meant as a
server/end-user app but the self-test code runs a certstore server as one of
its tests in the fuction testSessionHTTPCertstoreClientServer().  It doesn't
do the PGP stuff for boring implementation reasons, but it does all the X.509-
related bits.

Peter.