Subject: RE: I-D ACTION:draft-ietf-pkix-pi-08.txt

From: Tom Gindin <[email-masked]>
Date: Fri, 14 May 2004 13:57:41 -0400

Al:

        The serialNumber attribute is not expected to contain the 
certificate serial number.  In its original definition it was supposed to 
contain the serial number of a piece of physical equipment, and it's 
defined to be a string rather than an integer like the certificate serial 
number.  There was a lot of discussion about which field to use for 
national identity numbers back in the fall of '99 as part of QC (see the 
thread of http://www.imc.org/ietf-pkix/old-archive-99/msg03041.html for an example), and the use is reflected in RFC 3739 section 3.1.2 (and 
also in the corresponding section of RFC 3039).
        IMHO, PI is better than this use of serialNumber, but serialNumber 
is not as unacceptable as it would be if it were supposed to match the 
certificate serial number.

                Tom Gindin

"Al Arsenault" <[email-masked]>
Sent by: [email-masked]
05/12/2004 09:30 PM

        To:     "Anders Rundgren" <[email-masked]>, "David P. Kemp" 
<[email-masked]>, <[email-masked]>
        cc: 
        Subject:        RE: I-D ACTION:draft-ietf-pkix-pi-08.txt

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Anders Rundgren
> Sent: Wednesday, May 12, 2004 5:01 PM
> To: David P. Kemp; [email-masked]
> Subject: Re: I-D ACTION:draft-ietf-pkix-pi-08.txt
> 
> 
> 
> >It is my hope that PI will become an RFC in the near future, so
> >that certificates (from an un-named large PKI :-) that currently
> >handle PIs by munging them into Common Name (e.g.,
> >CN="Kemp.David.P.0514101404") will have a saner alternative.
> 
> The de-facto standard, already engraved in *millions* of certs is
> putting 0514101404 in serialNumber. 
> 
> 

The problem with that is that "0514101404" is not expected to change; it's 
a number which stays with you as long as you're an employee of the 
company, or as long as you're a customer, or even all of your life.

The serialNumber is expected to change every time the certificate changes 
- commonly, when a certificate expires once a year, the new certificate 
has a new serialNumber.  It's considered seriously bad form to issue a 
"renewed" certificate with a different validity period and the same 
serialNumber.

Thus, those who put 0514101404 in "serialNumber" are just setting 
themselves up for trouble later on down the road.

(And as I've pointed out numerous times before, I know of organizations 
that put the equivalent of "0514101404" in subjectAltName, as a DNS Name! 
It's certainly possible, but that doesn't make it the "right thing" to do.

                                                 Al Arsenault