Subject: RE: Any Organization Certificates out there?

From: "Pei, Mingliang" <[email-masked]>
Date: Fri, 9 Nov 2001 12:15:29 -0800

Hi Anders,

The server certificate issued by VeriSign actually meet your need.
"a unique ID" DUNS number is included in server certificates.
When a customer provides their DUNS# during enrollment for retail 
Secure/Global server ID to VeriSign CA, the certificate issued 
always includes the DUNS# in the server id extension which OID is 
2.16.840.1.113733.1.6.15

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Tuesday, November 06, 2001 2:07 PM
To: [email-masked]
Subject: Any Organization Certificates out there?

Hi,
My company is spearheading an effort to create an all
PKI-enabled version of the OBI (Open Buying on the Internet)
standard.  A stumbling block is that the core is based on what
we refer to as a "Digital Company Paper", which is an
organization certificate.  Some people consider Web-server
certificates as organization certificates, and that is true to
some extent, but has a major limitation: A domain name may
be owned by one legal entity and used by many associated
legal entities.  And the typical (non-standardized) other
information like O=x and OU=y is essentially useless
as it is not guaranteed to be unique or stable.  L (Locality) is even
worse as companies relocate quite often.  What you need
are certificates that contains a unique ID in a specified
fictitious (CA-specific) or externally administered
naming domain (National, DUNS etc).

Without such certificates, PKI-based B2B-business will be hard
to achieve as RP's sort of have to guess what IBM legal unit is
associated with a "secure.ibm.com" web-server certificate.
Particularly long-term, usage will break every now and
then due to the "imprecise" way, non-DNS information is applied.
And each renewed cerificate or changed web-server name (like
"secure0.ibm.com" to "secure9.ibm.com" replaces "secure.ibm.com")
is also a possible source of RP-troubles.  At least if plug-and-play
is called for, as in OBI Express.

Do anybody know if there are any *real* organization certificates
out there, available on a *global scale*?

Regards
Anders Rundgren
X-OBI
+46 70 - 627 74 37

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 9 Nov 2001 22:02:09 +0100

Ming,
Interesting.  I put this queston a week ago to [email-masked]
and got no such information!

Then I "dumpasn1":ed https://www.versign.com and there is
no such extension there.

I'm sure this information of yours is correct but it seems to be a
pretty well hidden secret.  And why not put DUNS in OID.2.5.4.5
so it is shows up where the other ID-stuff is?
Or as an extra O=DUNS:887878787?

Under all circumstances a short test verified that few are DUNS-enabled
today.

Anders

----- Original Message ----- 
From: "Pei, Mingliang" <[email-masked]>
To: "'Anders Rundgren'" <[email-masked]>; <[email-masked]>
Cc: "Hsiao, Wentsung" <[email-masked]>
Sent: Friday, November 09, 2001 21:15
Subject: RE: Any Organization Certificates out there?

Hi Anders,

- Ming

-----Original Message-----
From: Anders Rundgren [mailto:[email-masked]]
Sent: Tuesday, November 06, 2001 2:07 PM
To: [email-masked]
Subject: Any Organization Certificates out there?

Hi,

Regards
Anders Rundgren
X-OBI
+46 70 - 627 74 37

---

From: Michael Ströder <[email-masked]>
Date: Sat, 10 Nov 2001 00:47:55 +0100

> Then I "dumpasn1":ed https://www.versign.com and there is

Searching for 2.16.840.1.113733.1.6.15 on Google only returns this
link:

http://jcewww.iaik.at/servlet/demo.sslserverinfo.SSLServerInfoServlet/info?hostname=zvinet.creditanstalt.co.at&port=443

Extension 2.16.840.1.113733.1.6.15 does not seem to be well
documented though...

Ciao, Michael.