Please review draft-ietf-capwap-protocol-specification's use of certificates

[Sam Hartman <hartmans-ietf@xxxxxxx>]

Hi, folks.  The capwap working group is preparing to last call their
protocol specification draft.

I'd appreciate review from the pkix community of section 2.4.4.3 and
12.6 of this draft.  These sections specify certificate validation and
certificate usage for the protocol.  Scott Kelly and Charles Clancy
are security advisors for the working group and have been heavily
involved.

The capwap certificate profile assumes that the CN in the certificate
has structure and contains an ethernet MAC address.  The capwap
certificate profile also assumes that parts of the subject name such
as the organization and organizational unit will be important to
certificate matching.

I'd appreciate review and comments.

--Sam