Subject: [Uta] Client Certificates in RFC 7925

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 27 May 2020 06:49:00 +0000

Hi all,

I wanted to bring up another topic that may need to be clarified in draft-tschofenig-uta-tls13-profile-04

RFC 7925 says the following about client certificates:

"4.4.2<https://tools.ietf.org/html/rfc7925#section-4.4.2>.  Certificates Used by Clients

   For client certificates, the identifier used in the SubjectAltName or

   in the leftmost CN component of subject name MUST be an EUI-64.
      "

It turns out that many IoT deployments use identifiers different than EUI-64 numbers, and populate these identifiers in other places in the X.509 certificate.

I believe we have to update this recommendation to match deployment reality.

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: "Olle E. Johansson" <[email-masked]>
Date: Wed, 27 May 2020 09:04:33 +0200

> On 27 May 2020, at 08:49, Hannes Tschofenig <[email-masked] <mailto:[email-masked]>> wrote:
> 
> Hi all, 
>  
>  <>
> “4.4.2 <https://tools.ietf.org/html/rfc7925#section-4.4.2>.  Certificates Used by Clients
>  
>       “
Hmm. It doesn’t say how to include it in SAN fields. Anyone that understand how?

> It turns out that many IoT deployments use identifiers different than EUI-64 numbers, and populate these identifiers in other places in the X.509 certificate.
Agree
> I believe we have to update this recommendation to match deployment reality.
Sounds like a fair plan.

/O