Subject: Entrust certificate storage

From: "Tammy Carter" <[email-masked]>
Date: Fri, 20 Nov 1998 12:12:25 -0700

My understanding of X.509 is that certificates should be stored in an X.500 directory in their binary DER encoded format.  However, after talking with a person who has been using Entrust to store user certificates in the directory (in the userCertificate attribute), it appears that Entrust stores a user's certificates in some kind of ASCII translation of the DER encoding?  My source reports that a dump of what is actually being stored via LDAP is "{ASN1}..." followed by a translation of the hex into ASCII.  Apparently, Entrust also reads out any certificates stored in a binary DER encoding in the attribute, translates them to ASCII, and then writes them back to the directory.

Is my understanding of X.509 correct?  Is Entrust following some kind of standard?  Has anyone else noticed this behavior?

Tammy Green Carter
[email-masked]

---

From: Christopher Oliva <[email-masked]>
Date: Fri, 20 Nov 1998 16:58:02 -0500

Hi,

Entrust transfers the certificate and other signed objects within the LDAP
protocol using the binary DER encoding. It is also possible to configure the
Entrust software to use an ASCII representation of the DER encoding instead.
In this case, the ASCII encoding is applied after the DER encoding has been
rendered so that the DER encoding is preserved. The ASCII representation is
supported for interoperability with directory systems which do not support
binary attribute syntaxes. If you would like to follow-up further, let's
take the discussion off the list, since it is not a PKIX issue. Please feel
free to contact me directly.

-----------------------------------------
Chris Oliva
Entrust Technologies

(613) 248-3014
[email-masked]
http://www.entrust.com
-----------------------------------------

> ----------
> From: 	Tammy Carter[SMTP:[email-masked]]
> Sent: 	Friday, November 20, 1998 2:12 PM
> To: 	[email-masked]
> Subject: 	Entrust certificate storage
> 
> My understanding of X.509 is that certificates should be stored in an
> X.500 directory in their binary DER encoded format.  However, after
> talking with a person who has been using Entrust to store user
> certificates in the directory (in the userCertificate attribute), it
> appears that Entrust stores a user's certificates in some kind of ASCII
> translation of the DER encoding?  My source reports that a dump of what is
> actually being stored via LDAP is "{ASN1}..." followed by a translation of
> the hex into ASCII.  Apparently, Entrust also reads out any certificates
> stored in a binary DER encoding in the attribute, translates them to
> ASCII, and then writes them back to the directory.
> 
> Is my understanding of X.509 correct?  Is Entrust following some kind of
> standard?  Has anyone else noticed this behavior?
> 
> Tammy Green Carter
> [email-masked]
>