Subject: User certificates

From: "Erik Andersen" <[email-masked]>
Date: Tue, 24 Mar 2009 14:39:17 +0100

The term "user certificate" is used in X.509 (and X.511) without being
defined. I assume that a user certificate is a public-key certificate issued
to  an end-user. There is an attribute type called userCertificate, which
has the syntax of public-key certificates. It seems therefore clear that a
user certificate cannot be an attribute certificate.

In the "8.6.2.7 AA Issuing Distribution Point extension" the term user
certificate is mentioned in last the paragraph just before the three notes.
Is that correct?

The term "user certificate" should be defined.

Any comments?

Erik Andersen

Andersen's L-Service

Elsevej 48, DK-3500 Vaerloese

Denmark

Mobile: +45 2097 1490

email: [email-masked]

www.x500.eu

www.x500standard.com

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 24 Mar 2009 09:37:17 -0700

Bill,

Here is the definition from X.509:

A user may obtain one or more public-key
certificates from one or more
CAs. The userCertificate attribute type contains the public-key
certificates a user has obtained from one or more CAs.

So, it cannot be used to hold attribute certificates.  There is a
separate set of attributes to hold attribute certificates.  For
example, attributeCertificateAttribute:

The [attributeCertificateAttribute] contains
attribute certificates issued to a specific holder and is stored in the
directory entry of that holder.

But, I am surprised to hear that most applications assume only one
certificate in the userCertificate attribute.  In most directory
entries that I see for end users, there are two certificates in the
userCertificate attribute: a digital signature certificate and a key
management certificate.

Dave

Bill Russell wrote:

I believe
the directory attribute userCertificate is a multivalue attribute. I
see no reason why it cannot be used to store an attribute certificate.
However, some applications may get confused. I think in practice, most
apps assume only one certificate in the userCertificate.

The term "user" has
proved ambiguous; so, I'd agree that there would be some value in
defining it. However, I would not define it to exclude attribute
certificates.