Re: encoding an X.509 certificate

["Tom Scavo" <trscavo@xxxxxxxxx>]

On Thu, Nov 6, 2008 at 3:36 PM, Ben Laurie <ben@xxxxxxxxx> wrote:
>
> Obviously the signature will only verify if it is DER encoded. So,
> there's generally not much point in supporting other encodings.

Well, that brings up a good point, which I neglected to make clear.
The SAML profile that makes use of the XML structure posted earlier
does not require that the certificate in question be validated by the
receiving party.  The certificate is merely a container for a public
key, for which the client proves possession of the corresponding
private key, nothing more.

If the receiving party is a SAML identity provider, the presented
certificate is bound to a SAML assertion (using the XML structure
posted earlier).  If the receiving party is a SAML service provider,
the presented certificate is compared to the certificate bound to the
SAML assertion.  So the actual encoding applied to the certificate is
not important, except of course the identity provider and the service
provider need to be on the same page, otherwise certificate comparison
at the service provider will fail.

Obviously, if the identity provider is required to bind a base64
encoding of a DER-encoded certificate, the service provider will have
no problem (or so it seems), but there are some who are inclined not
to specify DER explicitly, to future-proof the profile, as it were.

I hope this helps to clarify.  I had hoped to avoid the details but I
see that may not be possible.

Thanks,
Tom