Subject: RE: WG Last Call: Son-of-2459

From: David Cross <[email-masked]>
Date: Tue, 6 Mar 2001 15:04:23 -0800

Steve:

->Anyway, since it is clear that not all folks will issue cross certs 
as I suggested, I have to admit to liking the fallback position of 
allowing specification of name constraints as part of the validation 
procedure, on a per trust anchor basis. The main argument I've seen 
is the one that questions whether this should be a user configurable 
parameter, or an administrative parameter, or whether this is a MAY 
(vs. SHOULD/MUST), which allows vendors to ignore the facility 
entirely.

I would strongly disagree against allowing name constraints to be a user
configurable parameter.  This defeats the administrative value and assurance
that name constraints provide.

David B. Cross

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 7 Mar 2001 08:06:27 +0100

Just downloaded a new Thawte freemail certificate and found that they
now also have fitted the Subject with the e-mail address.  I.e. they now conform
to the de-facto standard.  If 99% do not consider Son-of-2459 be the norm,
it is 2459 that should change and not the world.

In the OASIS-group which I participate they say that: "A standard is not
a standard until deployed".

Anders

---

From: Stephen Kent <[email-masked]>
Date: Wed, 7 Mar 2001 10:56:33 -0500

>a standard until deployed".

Perhaps this is an indication that your freemail certificate is worth 
what you paid for it :-).

Steve