Re: How to identify certs to users

[tgindin@xxxxxxxxxx]

     Since an rfc822Name inside GeneralName is defined as being an RFC 822
addr-spec (see RFC 2459 section 4.2.1.7), which is defined as
local-part@domain (RFC 822 section 6.1), the form "Personal Name
<local-part@domain>" is not legal for it according to PKIX.  The
difficulty, I suppose, is that a lot of software would treat this as being
an RFC 822 mailbox, for which that form is legal, especially since X.509
(1997) calls it "an Internet electronic mail address defined in accordance
with Internet RFC 822", which could plausibly be interpreted as either
mailbox or addr-spec.  I don't know if there are any corrections to X.509
on this yet, but if not there probably should be.

          Tom Gindin