Subject: PKI-LDAP interaction questions

From: [email-masked]
Date: Mon, 02 Nov 98 10:20:57 -0500

All,
 
I have some basic questions on storing pki certificates on 
LDAP servers (am new to this stuff so apologise if I am 
missing something straightforward). 

1. Seems like several possible objectclasses can be used to store
certificates on an LDAP directory. draft-ietf-pkix-LDAPv2-schema-02.txt
mentions that the classes pkiUser and pkiCA MAY be used as part of other
objects to store certificates. The netscape directory server has objects like
strongAuthenticationUser and inetOrgPerson which contain attributes for 
certificates. It would appear that there is no standard objectClass 
which a PKI entity can use to search for on a directory. So, PKI entities
should know the exact DN of the entry (which is known out of band) to 
contain the certificate they are looking for (and not search for a 
particular object class), correct ? 

2. Are PKI entities supposed to know the format under which a certificate
is stored in a directory entry ? or is it always mandated to be DER ? 
(note: the netscape directory server has two kinds of attributes 
userCertificate and userCertificate;binary ...). 

3. The DN which a PKI entity uses to request a certificate from a CA need 
not be related in any way to the DN of the entry in which it is stored in the 
LDAP directory (though it might be convenient for them to be the same)
correct ?

4. The process by which a certificate published by a CA is installed on an 
LDAP directory is essentially expected to be out of band correct ? 
(though some CAs may provide the facility to include an LDAP client and 
directly load the certificate onto a specified directory server (if provided
the LDAP bind and DN information etc...).

Thanks,

Sanjeev.