Subject: Re: 3280bis: name constraints

From: Peter Sylvester <[email-masked]>
Date: Tue, 16 Nov 2004 19:58:43 +0100 (MET)

> 
> The fact that the extension is a name constraint becomes immaterial if the 
> path building software chooses to ignore it.
> The software may ignore the extension if it is marked as non critical,  as 
> per rfc 3280.
> 
> In practice, there may be some benefits to marking the name constraint 
> extension non critical.
> RP may configure the path building software to ignore/enforce the extension 
> based on the importance of the transaction.
> e.g. - for email validation, the RP may configure the path validation 
> software to ignore name constraints.
>       - for a million dollar internet transaction, the RP may configure the 
> software to always enforce name constraints.

RP software may also simply not be able to support constraints
And since this is actually a constraint for CAs, consequences of violation
may be enforcable by organisational means. "Dear CA, we told you not to
issue certs with these constraints."

---

From: Peter Sylvester <[email-masked]>
Date: Tue, 16 Nov 2004 19:58:43 +0100 (MET)