Subject: [ietf-provreg] RE: Certificate Validation and Subject Analysis

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 7 Dec 2006 07:05:19 -0500

> -----Original Message-----
> From: Alexander Mayrhofer [mailto:[email-masked]] 
> Sent: Thursday, December 07, 2006 5:26 AM
> To: [email-masked]; Hollenbeck, Scott
> Subject: Re: Certificate Validation and Subject Analysis
> 
> > I received a question from an IESG member about EPP 
> implementations and
> > X.509 digital certificate validation.  What are 
> implementers doing with
> > the certificate subject name information when validating the
> > certification path of a client or server?  Is the name 
> being examined
> > and/or used for authentication or access control purposes?
> 
> Scott,
> 
> we're now using two different toolkits - one homegrown (for 
> User-ENUM), and
> Net::DRI (for upcoming .at registry, plus infrastructure ENUM).
> 
> Neither of those toolkits currently does anything with the 
> certificates
> provided be the registry - TLS is hence only used for 
> encryption, not for
> authentication.
> 
> that might change in the future, so any guidance about what to do is
> appreciated.

I think you'll find that guidance in the next update of 3734bis.  Two
IESG members have said that the document needs text to require use of
the certificate subject as part of the authentication process.  I hope
to have the final version ready for IESG approval in the next day or so.
I'm just waiting for one IESG member to confirm that the changes are
acceptable.

-Scott-

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Thu, 7 Dec 2006 12:56:08 -0500

Sorry, after reading this again I don't think I was very clear.  The IESG folks believe that the certificate validation requirements are inherited through our dependency on TLS.  TLS includes a reference to the PKIX certificate specs.  They don't see the requirement as an EPP requirement, but a TLS requirement.

-Scott-

 -----Original Message-----
From: 	Hollenbeck, Scott [mailto:[email-masked]]
Sent:	Thursday, December 07, 2006 11:25 AM Eastern Standard Time
To:	Frank Thompson; Francisco Obispo
Cc:	Alexander Mayrhofer; [email-masked]
Subject:	RE: [ietf-provreg] Re: Certificate Validation and Subject Analysis

> From: Frank Thompson [mailto:[email-masked]] 
> Sent: Thursday, December 07, 2006 10:37 AM
> To: Francisco Obispo
> Cc: Alexander Mayrhofer; [email-masked]; Hollenbeck, Scott
> Subject: Re: [ietf-provreg] Re: Certificate Validation and 
> Subject Analysis
> 
> 
> Hello,
> 
> Afilias does not employ CN idenity ACL checking either for the same 
> reasons as NIC.VE, but use other hardware/software solutions 
> for client 
> idenity and IP ACL validation.
> 
> Therefore we also believe that this does not belong in the 
> EPP protocol.

Well, you guys will need to take that up with the IESG after reviewing
RFC 3280.  In the mean time, what do you do if the certificate presented
from a client has valid certification path signatures, but the names
have nothing to do with that client?

-Scott-