Re: CA vs. EE cert processing

[Paul Hoffman / IMC <phoffman@xxxxxxx>]

This summary is great. However, I come to slightly different conclusions 
than you do, based on the same logic. My conclusion is that X.509 by itself 
is broken due to the (now glaring) ambiguity. RFC 2459, though no paragon 
of clarity, fixes the problem of X.509. Thus, *any* CA vendor or cert 
authority who doesn't follow RFC 2459, for at least this part of the cert, 
is using a broken protocol.

<gratuitous-swipe>
Folks who implement protocols that start with "X." are used to this kind of 
ambiguity. Let them figure out how to fix it.
</gratuitous-swipe>

Should we have added an "ConformsToRFC2459" attribute to RFC 2459?

--Paul Hoffman, Director
--Internet Mail Consortium