Subject: Re: [pkix] Way Forward: Name Constraints Criticality

From: Steve Howard <[email-masked]>
Date: Thu, 31 May 2012 10:47:11 -0500

I have been watching this thread with interest.  So far, the discussion does
not contemplate bridged infrastructure.  Rather, the predominance of the
discussion is driven by the PKI up to a WKR.

As a bridge, CertiPath does apply name constraints, and we mark them
critical, for our enterprise customers.  We find this both useful and not to
be an interoperability issue for our customers.

Respectfully,
Steve

Stephen P. Howard | Vice President, Credentials | CertiPath LLC
2300 Corporate Park Drive, Ste 150, Herndon, VA 20171
PH +1.703.793.7879 | Direct +1.703.319.3171 | FAX +1.703.773.6262
Email [email-masked]
CertiPath: Enabling Trusted Communication www.certipath.com

-----Original Message-----
From: Wan-Teh Chang [mailto:[email-masked]] 
Sent: Wednesday, May 30, 2012 7:31 PM
To: IETF PKIX
Subject: Re: [pkix] Way Forward: Name Constraints Criticality

RFC 2459 (a predecessor of RFC 5280) is 129 pages long.

Isn't it possible that the reviewers of such a long document may have
overlooked the full implications of "[The name constraints] extension MUST
be critical"?

Is the US DoD using the name constraints extension?

Thanks,
Wan-Teh