Re: I-D ACTION:draft-ietf-pkix-certstore-http-03.txt

[pgut001@xxxxxxxxxxxxxxxxx (Peter Gutmann)]

"Tom Gindin" <tgindin@xxxxxxxxxx> writes:

>Of course I have no objection to mentioning a preference for subjectAltName
>over subject for e-mail addresses.  I just thought that anybody actually
>implementing something which extracts e-mail addresses from certificates
>would be helped by knowing all the places which are used in large numbers of
>certificates, not just the approved ones.  In the earlier wording ("an
>rfc822Name attribute") I wasn't sure whether implementors would interpret
>this as the rfc822mailbox directory attribute or the rfc822Name component of
>GeneralName, anyway.

I've actually reworded it to use mostly a very generic "email address
associated with the cert" (someone pointed out that there doesn't actually
have to be an email address in the cert for it to be associated with one). The
intent was never to provide an exhaustive enumeration of all possible places
it could be hidden, just to say that it was whatever address(es) were
associated with the cert.

Peter.