[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: New Liaison Statement, "Liaison to IETF on the resolution of DR320"


At 12:37 PM -0400 10/19/07, Tom Gindin wrote:

        I know this response is a little late, but the main reason that
there is no central repository for CA names is that there is no world-wide
directory using X.500 names.
While the latter is obviously true, it is not the "main reason". The "main reason" is that many (most?) CAs could get no real value out of a "world-wide directory using X.500 names". For example, when an organization becomes a CA by making its own trust anchor for internal use, having to register in a "world-wide directory" is a hindrance, not a feature. 


For reasons which have been discussed many
times on this list, there probably never will be.


"Probably" may be understating the likelihood.


Of course,  the IETF
knows of an existing registry which could be used to avoid conflicts
between CA names.


We do?


        How about the following wording: "Certificate Authorities SHOULD
NOT use a value in the Organization or Common Name attribute of their
Distinguished Name which is syntactically legal as a dNSName (i.e. an IA5
string containing one or more periods but no spaces) unless they are
operated by an organization which has registered the domain name
controlling that dNSName.  Certificate Authorities wishing to ensure a
globally unique issuer name MAY use an IA5 FQDN controlled by their
organization in either the Organization or the Common Name attribute."
This might be appropriate in an ITU document, but is it really appropriate for a standards-track IETF document? In specific, the latter makes it sound like using your domain name is safe. Might be, might not be. 


Does anybody want to add Organizational Unit into the mix, and possibly
even make it a SHOULD for newly allocated CA's?
I don't see how this would help. If you look at the OUs in IssuerNames of certificates flying around the net, you can see that few people understand OUs, 


        Given my unfamiliarity with non-alphabetic scripts, I hesitate to
discuss internationalized DNS names in this connection unless Punycode is
relevant.  However, even without considering DR 320, using somebody else's
domain name as your CN or O attribute is misleading.
True, but I do not think that it is the place of IETF documents to say what is or is not "misleading". 

--Paul Hoffman, Director
--VPN Consortium