Subject: 3280bis: DNS name constraints

From: "Manger, James H" <[email-masked]>
Date: Wed, 17 Nov 2004 12:26:39 +1100

Shouldn't the DNS name constraint use the same rules as for host part of
URIs and email addresses?
For DNS names, RFC 3280 says "simply adding to the left hand side of the
name satisfies the name constraint" [4.2.1.11, page 38].  This implies a
constraint of "foo.bar.com" is satisfied by "myfoo.bar.com" -- which
must be an error.

---

From: "David A. Cooper" <[email-masked]>
Date: Thu, 18 Nov 2004 12:10:14 -0500

>constraint of "foo.bar.com" is satisfied by "myfoo.bar.com" -- which
The language in 3280bis will be changed to make it clear that 
"myfoo.bar.com" does not fall within the subtree of "foo.bar.com" since 
"myfoo.bar.com" is not hierarchically subordinate to "foo.bar.com".  The 
actual rule is that "foo.bar.com" is satisfied by "foo.bar.com" and any 
domain name that can be constructed by adding additional subdomains to 
the left hand side of "foo.bar.com".

Note that the constraints for DNS names still differ from those for 
rfc822Name and URIs.  For URIs (and rfc822Name), one can either specify 
all URIs on a particular host or all URIs on hosts whose DNS names are 
subordinate to the specified DNS name. For DNS names, one can only 
specify a subtree that includes both the specified DNS name and DNS 
names that are hierarchically subordinate to the specified name.  I 
don't think that there is a compelling reason to provide additional 
options for specifying DNS name constraints.

Dave