Subject: [certid] False choice for CN

From: Paul Hoffman <[email-masked]>
Date: Fri, 11 Jun 2010 17:19:38 -0700

>   1.  The certificate MUST include a "DNS-ID" (i.e., a subjectAltName
>       identifier of type dNSName).

. . .

>   Therefore, if and only if the identity set does not include
>   subjectAltName extensions of type dNSName, SRVName, or
>   uniformResourceIdentifier (or any application-specific subjectAltName
>   extensions supported by the client), the client MAY as a fallback
>   check for a fully-qualified DNS domain name in the last Common Name
>   RDN in the sequence of RDNs making up the Distinguished Name within
>   the certificate's subjectName (where the term "last" refers to the
>   DER order, which is often not the string order presented to a user;
>   the order that is applied here MUST be the DER order).

Bzzzzzt! All of 3.4.4 is bogus, given that DNS-ID is required. Please remove it.

--Paul Hoffman, Director
--VPN Consortium

---

From: Martin Rex <[email-masked]>
Date: Mon, 14 Jun 2010 16:12:37 +0200 (MEST)

> Bzzzzzt! All of 3.4.4 is bogus, given that DNS-ID is required. Please remove it.

I think this needs to stay.

The document under discussion is supposed to be a BCP (Best current practice)
document, and it will have to describe how clients should deal with
server certificates that do no have subjectAltNames.  It does so by
describing the common practice that has been in use for certs that
do not have subjectAltNames.

-Martin

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 14 Jun 2010 19:55:27 -0700

>do not have subjectAltNames.

That goes counter to the MUST-level statements in the document. You either need to downgrade the MUST-level requirements, or get rid of the sections that say, in essence, "if this MUST-level requirement is not met, then do this".

The fact that this is a BCP is irrelevant. BCPs are standards-track documents. Being a BCP doesn't make it OK to have conflicting requirements.

--Paul Hoffman, Director
--VPN Consortium

---

From: "Henry B. Hotz" <[email-masked]>
Date: Mon, 14 Jun 2010 22:41:10 -0700

> The fact that this is a BCP is irrelevant. BCPs are standards-track documents. Being a BCP doesn't make it OK to have conflicting requirements.

The section in question describes what one party is supposed to do if the other party does the wrong thing.  I see nothing inconsistent or inappropriate about that.  

It's just sad that the current (actual, not best) practice is to do "the wrong thing" so often that we need to worry about it so much.

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Jun 2010 16:16:48 -0600

On 6/14/10 8:55 PM, Paul Hoffman wrote:
>>>> 1.  The certificate MUST include a "DNS-ID" (i.e., a
>>>> subjectAltName identifier of type dNSName).
>>> 
>>> . . .
>>> 
>>>> uniformResourceIdentifier (or any application-specific
>>>> subjectAltName extensions supported by the client), the client
>>>> MAY as a fallback check for a fully-qualified DNS domain name
>>>> in the last Common Name RDN in the sequence of RDNs making up
>>>> the Distinguished Name within the certificate's subjectName
>>>> (where the term "last" refers to the DER order, which is often
>>>> not the string order presented to a user; the order that is
>>>> applied here MUST be the DER order).
>>> 
>> The document under discussion is supposed to be a BCP (Best current
>> practice) document, and it will have to describe how clients should
>> deal with server certificates that do no have subjectAltNames.  It
>> does so by describing the common practice that has been in use for
>> certs that do not have subjectAltNames.
> 
> That goes counter to the MUST-level statements in the document. You
> either need to downgrade the MUST-level requirements, or get rid of
> the sections that say, in essence, "if this MUST-level requirement is
> not met, then do this".

I think this list is leaning toward saying that DNS-ID is a SHOULD, not
a MUST, so the quoted text would be appropriate.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/