Subject: [pkix] Role specification in public-key certificates

From: "Erik Andersen" <[email-masked]>
Date: Sat, 28 Apr 2012 10:17:06 +0200

If you want to specify the role of the subject in a public-key certificate,
where would be the most appropriate place?

Erik Andersen

---

From: Stephen Wilson <[email-masked]>
Date: Sat, 28 Apr 2012 22:38:08 +1000

In modern closed PKI, I suggest role should be specified in detail in 
the Certificate Policy of a defined community of certificate holders; 
then the unique Policy OID stands for the role in question.  For 
reasonably long lived roles in need of certificates, we should issue a 
different certificate for each role.

See also http://lockstep.com.au/library/pki/relationship_certificates.html

Cheers,

Steve Wilson.

Lockstep

http://lockstep.com.au <http://www.lockstep.com.au>
Lockstep Consulting provides independent specialist advice and analysis
on digital identity and privacy.Lockstep Technologies develops unique
new smart ID solutions that enhance privacy and prevent identity theft.

On 28/04/2012 6:17 PM, Erik Andersen wrote:
>
> If you want to specify the role of the subject in a public-key 
> certificate, where would be the most appropriate place?
>
> Erik Andersen
>
>
>
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Michael StJohns <[email-masked]>
Date: Sat, 28 Apr 2012 11:16:46 -0400

How about in an attribute certificate?  Specifically with the role attribute.    That's sort of what they're there for.  

Sent from my iPad

On Apr 28, 2012, at 4:17, "Erik Andersen" <[email-masked]> wrote:

> If you want to specify the role of the subject in a public-key certificate, where would be the most appropriate place?
>  
> Erik Andersen