Subject: RE: How to send class info from RA to CA

From: Carlisle Adams <[email-masked]>
Date: Wed, 21 Mar 2001 11:25:14 -0500

Hi Vivek,

> ----------
> From: 	vivek saraf[SMTP:[email-masked]]
> Sent: 	Wednesday, March 21, 2001 5:08 AM
> To: 	[email-masked]
> Subject: 	How to send class info from RA to CA
> 
> Hello,
> 
>    I have a CA running which issues multiple classes
> of certifiactes. Now when RA requests a certifiacte
> for a user, the RA should specify the class for which
> it is requesting, but in the PKI message i don't find
> any field for sending the class information.
> 
> I have Free text in the PKI Header, if i use this it
> will not be inter operable.
> 
> Can any body help me
 
How does the issued certificate indicate what class it is?  Is it by some
extension, or is it by an indicator somehow embedded in the name of the
subject or the issuer?  Whatever mechanism you choose to use, all you have
to do is use the same mechanism in the certTemplate in the request message
from the RA to the CA.  This is why the certTemplate exists; it allows the
requester to specify to the CA exactly the cert contents that are important
to them.

Carlisle.

---

From: [email-masked] (Terry Hayes)
Date: Wed, 21 Mar 2001 08:45:26 -0800

As Carlisle has indicated, the certificate template field can include 
data that will indicate the "class" of the request.  A prime candidate 
for this purpose is the certificatePolices extension.  The policy (or 
policies) included in this field should be a good indicator of the type 
of certificate desired.

Terry

Carlisle Adams wrote:

> How does the issued certificate indicate what class it is?  Is it by 
> some extension, or is it by an indicator somehow embedded in the name 
> of the subject or the issuer?  Whatever mechanism you choose to use, 
> all you have to do is use the same mechanism in the certTemplate in 
> the request message from the RA to the CA.  This is why the 
> certTemplate exists; it allows the requester to specify to the CA 
> exactly the cert contents that are important to them.
> 
> Carlisle.
>

---

From: vivek saraf <[email-masked]>
Date: Thu, 22 Mar 2001 03:18:06 -0800 (PST)

Hello Carlise,

     Thanks, I got your point, i will use the issuer
key identifier extension in the certTemplate to
identify the CA.

Regards,
Vivek Saraf

> contents that are important

__________________________________________________
Do You Yahoo!?
Get email at your own domain with Yahoo! Mail. 
http://personal.mail.yahoo.com/