Re: Wildcard DNS. Re: rfc 3280bis

["Anders Rundgren" <anders.rundgren@xxxxxxxxx>]

Dave,
I think you are touching another issue, SAN is not always used
( https://www.verisign.com ) and for wildcards it does not make
sense to use it either since all clients understand CN.
For multiple discrete hosts SAN is of course used.

Home-brewed wild-card certificate (which apparently
is accepted by Microsoft's CardSpace):
https://infocard.pingidentity.com/cardspace/

If your desire is outlawing wildcards in SAN I guess you have
no problem but OTOH I don't see that you got rid of *.domains
which I thought was the prime consideration.

Anders

----- Original Message ----- 
From: "David A. Cooper" <david.cooper@xxxxxxxx>
To: "Anders Rundgren" <anders.rundgren@xxxxxxxxx>
Cc: "pkix" <ietf-pkix@xxxxxxx>
Sent: Thursday, January 24, 2008 00:19
Subject: Re: Wildcard DNS. Re: rfc 3280bis


Can you confirm that these wildcard SSL certificates include the DNS 
name in the dNSName field of the subjectAltName extension rather than in 
a common name attribute in the subject field?  I could not find any 
wildcard certificates, but the web site implies that the common name 
attribute is used in the wildcard SSL certificates and that the 
subjectAltName extension does not include DNS names with wildcards.

Dave

Anders Rundgren wrote:
> Certificates with wildcards are fairly widely used because they
> can save you both hassles and money.
>
> Issuer: https://www.godaddy.com/gdshop/ssl/ssl.asp?ci=8979  A major issuer of SSL certs.
>
> That is, it does not matter what 3280bis says, this is de-facto standard
> and I doubt that Microsoft intends to remove support for this in MSIE.
>
> If an issuer creates a certificate for *.com it is a bad issuer while
> *.mycompany.com is ok.  Bad issuers don't have their roots
> deployed in browsers so I don't see what the problem is.  If
> you have bad issuers nothing really helps.
>
> Anders
>
>
>