Subject: Infinite loop: See loop, infinite

From: [email-masked] (Peter Gutmann)
Date: Fri, 25 Jan 2002 23:31:15 +1300 (NZDT)

Found in a certificate which someone sent me:

7968 30  177:     SEQUENCE {
7971 06    3:       OBJECT IDENTIFIER subjectAltName (2 5 29 17)
7976 04  169:       OCTET STRING, encapsulates {
7979 30  166:           SEQUENCE {
7982 86  163:             [6] 'ldap://ldap.infocamere.it/cn%3DTUMEDEI%2FANGELO%'
            :                 '2FTMDNGL60A20D704Q%2F2001111345465%2Cou%3DCertif'
            :                 'icati%20di%20Firma%2Co%3DInfoCamere%20SCpA%2Cc%3'
            :                 'DIT?usercertificate'
            :             }
            :           }
            :       }

(the LDAP URL points back to the certificate which contains it).  In other
words to resolve the certificate altName, you go to the LDAP server and fetch
the certificate, which contains an altName, ...

I wonder what the semantics of such an item are?

(This is even more amusing than the wonderful Windows-produced certs with URLs
 like "file://\\bobs_win2K_box\blah.cer", which are going to be really useful
 to the world at large).

Peter.

---

From: Michael Ströder <[email-masked]>
Date: Fri, 25 Jan 2002 16:46:31 +0100

> I wonder what the semantics of such an item are?

Semantics of URLs in subjectAltName and issuerAltName are not
well-defined anyway.

>  like "file://\\bobs_win2K_box\blah.cer", which are going to be really useful

Well, that's a funny example. But file:-URLs might make sense within
an organization.

Ciao, Michael.