Subject: [ietf-provreg] Re: Certificate Validation and Subject Analysis

From: Alexander Mayrhofer <[email-masked]>
Date: Thu, 07 Dec 2006 11:25:56 +0100

> I received a question from an IESG member about EPP implementations and
> X.509 digital certificate validation.  What are implementers doing with
> the certificate subject name information when validating the
> certification path of a client or server?  Is the name being examined
> and/or used for authentication or access control purposes?

Scott,

we're now using two different toolkits - one homegrown (for User-ENUM), and
Net::DRI (for upcoming .at registry, plus infrastructure ENUM).

Neither of those toolkits currently does anything with the certificates
provided be the registry - TLS is hence only used for encryption, not for
authentication.

that might change in the future, so any guidance about what to do is
appreciated.

thanks

Alex Mayrhofer
nic.at

---

From: Francisco Obispo <[email-masked]>
Date: Thu, 7 Dec 2006 09:41:24 -0400

Hi,

I don't think it would be a good idea to introduce certificate
issued to the EPP protocol,

It's a transport issue, and it should not be brought to
the protocol

In our case (nic.ve) we are providing VPN tunnels to our
epp clients, as well as IP based ACLs and authentication.

Best regards

_____________________________
Francisco Obispo
Jefe de Oficina de NIC-VE
Centro Nacional de Tecnologías de Información