At 1:25 AM +0100 1/26/07, Milan Sova wrote:
Hi. In our project, we mark end entities with URNs and need to include these names in the certificates. We started with using subjectAltName.URI field for this (as URN is a "subtype" of URI). However, this practice clashes with RFC 3280 which explicitly requires absolute URL for the field. Is there any specific reason for excluding URNs from subjectAltName?
Yes, but it is not a good one in my opinion. The URI use in subjectAltName is only meant to be a host computer reach by a protocol, not a vanilla identifier such as a URN. Thus, there is the restriction that there has to be a host name.
If you want a URN, you should consider using otherName instead. This, of course, shows the silliness of the specificity of the uniformResourceIdentifier type, but it is needed if you want to follow 3280.
--Paul Hoffman, Director --VPN Consortium