Re: Can we form certificates with just name and e-mail address

[thayes@xxxxxxxxxxxx (Terry Hayes)]

Stefan Santesson wrote:

> ....
>
> Why can't an e-mail address be part of a reasonable DN? (I guess that's
> what the current text implies)
>

There is no reason that it can't be.  In fact, I believe that e=name@isp.com is a
perfectly good DN.  It's probably not a good DN in the X.509 world, since it isn't
very helpful in locating the portion of the "global" directory that actually
contains the entry.  It is a unique name and probably will work in many LDAP or
other directory environments.

The RFC deprecates using an email component of the DN as the RFC822 name for
delivering email.  This means that you need to put the email address in the
Subject Alternate Name extension as well, to allow S/MIME (and other) applications
to find it there.  It does not mean that it is disallowed as a component in the
DN.

Terry