Re: X.509 certificate and its subject name field

[Stephen Kent <kent@xxxxxxx>]

Peter,

	The cert fingerprint is a useful notion, when used in conjunction
with the rest of the DN.  By itself, it's an awful way to identify a user,
as it is not at all descriptive. It also fails to sastisfy one of the
attrributes that Marc and some others desire.  Specifically, a change to
any part of the cert will result in a new finmgerprint, and this means that
even if the user in question is still authorized, a largely irrelevant
change to the cert would invalidate the ACL entry.  I'm not suggesting a
better, single value to use, just pointing out that there may be no simple,
single attribute that will satisfy all of the criteria being proposed.

Steve