Re: Issues in LDAP schema IDs

[Antonio Lioy <lioy@xxxxxxxxx>]

Wen-Cheng Wang wrote:
>
> My concern is a CA may support dual key pairs for a single EE. One key pair
> is for digital signature usage; the other key pair is for encipherment usage. A
> CA
> may even support triple key pairs for a single EE if non-repudiation usage is to
> be
> separated from digital signature usage. Therefore, a CA may issues two or three
> certificates to an EE at a time. If the attribute is restricted to be single
> valued, how
> do these certificates be stored in the directory?

I can confirm that this is actually happening in Italy, where many 
legal-value CAs are giving to their customers three certs:
- one for non-repudiation
- one for authentication
- one for encryption

So support for multiple certs per each user should be added to the schema.

Cheers,

Antonio Lioy