> I'm not trying to be difficult either.Sam asked PKIX to review
PKI-specific parts of the spec and I did. I expect the IESG to ignore
my objection, given the deployed base you and others cite. But
let's be honest and
recognize that this was an error, probably based on bad advice given
to by the DOCSIS folks. Also note that PKIX RFCs have taken a strong
stand against putting inappropriate values into the CN field in the
past, e.g., stuffing an e-mail address there, despite the fact that
lots of certs were issued tha way.
If there really is a belief that this is an error, then the right
thing to do is for the
IETF (and PKIX WG) to inform the organizations involved (which now include
IEEE 802 as well as DOCSIS) of the error, as well as to suggest the correct
way of doing things. That way, the error might get fixed.
Merely fixing the CAPWAP protocol spec is only likely to make the
situation worse, not better, because then we'd have two ways of doing
the same thing with more on the way.