Subject: Re: Authenticated CERTSTORE URLs

From: [email-masked] (Peter Gutmann)
Date: Thu, 30 Jan 2003 18:28:09 +1300

"Anders Rundgren" <[email-masked]> writes:

>Assume that you do not "publish" certficates for everybody to see, but still
>allow coded out-of-band received URLs to do lookups.

I think in that case you should use whatever standard HTTP mechanisms you need
for it (passwords/MD5/SSL with client certs/whatever).  This is meant to be a
simple {key,value} lookup, and no more.

>A limitation in CERTSTORE is the exclusion of status information that a
>client can digest in a reasonable (=locale independent) way. Like "no such
>user", "no such certificate", and "invalid authentication - expired?"  (for
>the suggestion above).

Again, see above.  All you're doing is saying "Gimme the value associated with
this key".

Peter.