Subject: [pkix] RFC 5280/6818 X.509v3 DNS Name Constraints

From: Vyron Tsingaras <[email-masked]>
Date: Thu, 27 Mar 2014 07:08:46 +0200

I am not sure if this is the right place for this but here goes: What is the reasoning behind name constraints format for type “DNS name” as specified in RFC 5280? In other words why is it different from the URI scheme, where “.example.com” would satisfy *.example.com, *.*example.com BUT not example.com? Currently as it stands, a CA has no way to restrict itself from issuing certificates for example.com while allowing itself to issue for host.example.com. A NC for type DNS “example.com” will allow the CA to issue a certificate for example.comwhen the desired behavior would be to only allow “.example.com”(in URI scheme).  This could be undesirable. It seems like while the scheme for URIs and email where updated whereas the DNS scheme was left untouched. Wouldn’t it be better if the DNS scheme followed the other 2?

The relevant section is 4.2.1.10 in RFC 5280

--
Sent with mySecureMail.
http://www.mysecurephone.eu/

---

From: Tom Gindin <[email-masked]>
Date: Sat, 29 Mar 2014 22:22:57 -0400

I don't know if you'll consider this message fully responsive, but 
this practice has been the case since RFC 2459 in January '99.  X.509v3, 
which predates that, gave no format for DNS name constraints or those in 
any Internet format.  I joined the group shortly after RFC 2459, but it 
appears that at least two members agreed with you then: 
http://www.ietf.org/mail-archive/web/pkix/current/msg21192.html and 
http://www.ietf.org/mail-archive/web/pkix/current/msg21190.html
        For what it's worth I tend to agree with James' and Paul's point 
that permitting issuers to make that distinction makes sense.  That does 
not mean that adding it 15 years after the original is as clearly correct 
as it would have been then, and the PKIX group is no longer in a position 
to do anything about it.

Tom Gindin, CISSP
P.S.    The opinions above are mine, and not necessarily those of my 
employer

From:   Vyron Tsingaras <[email-masked]>
To:     [email-masked], 
Date:   03/27/2014 11:19 AM
Subject:        [pkix] RFC 5280/6818 X.509v3 DNS Name Constraints
Sent by:        "pkix" <[email-masked]>

I am not sure if this is the right place for this but here goes: What is 
the reasoning behind name constraints format for type ?DNS name? as 
specified in RFC 5280? In other words why is it different from the URI 
scheme, where ?.example.com? would satisfy *.example.com, *.*example.com 
BUT not example.com? Currently as it stands, a CA has no way to restrict 
itself from issuing certificates for example.com while allowing itself to 
issue for host.example.com. A NC for type DNS ?example.com? will allow the 
CA to issue a certificate for example.comwhen the desired behavior would 
be to only allow ?.example.com?(in URI scheme).  This could be 
undesirable. It seems like while the scheme for URIs and email where 
updated whereas the DNS scheme was left untouched. Wouldn?t it be better 
if the DNS scheme followed the other 2?

--
Sent with mySecureMail.
http://www.mysecurephone.eu/[attachment "smime.p7s" deleted by Tom 
Gindin/Watson/IBM] _______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix