Re: [TLS] TLS1.2: focus on non X.509 certs, cert URLs, authoirzation spaces, registration practices

[Mike <mike-list@xxxxxxxxx>]

> In TLS 1.1 however, we suddenly get constrained in 2006 re the encoding 
> of the DNs. The field has to
> be DER encoded, now. In SSL and TLS1.0 it was an opaque type (I.e. the 
> format/encoding is defined
> by the ClientCertificateType). (Tell Peter DER, and he assumes he has to 
> type check it, now, as DER,
> raising an exception if it fails the encoding rules for each attribute 
> type's value; this is a lot of code!)

I don't think you need to validate the DER encoding (or not) of the
distinguished names.  Just compare them to your own and if you find
a match, it must be DER encoded.  If you don't find a match, maybe
it wasn't DER encoded, or maybe your DN isn't supported.  Either way
you know what to do.

Mike

_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls