Subject: Re: [TLS] Update spec to match current practices for certificate chain order

From: Peter Gutmann <[email-masked]>
Date: Sat, 9 May 2015 13:09:14 +0000

Martin Rex <[email-masked]> writes:

>And every sensibly managed public CA ought to refuse signing the same public
>key for different names/identities/attributes (i.e. issuing different certs
>with the same public key).

ITYM "No true Scotsman would sign the same public key for different
names/identities/attributes".

(Also, no sensibly managed public CA will issue certs for RFC 1918 addresses,
unqualified domain names, "localhost", nonexistent domains, obviously bogus
domains like "your.server.address.com", and so on, so the tens of thousands of
certs like this that have been issued by public CAs must be a figment of our
imagination).

Peter.