Subject: Re: (Un)managing non-existent DNs in enrolments

From: [email-masked] (Peter Gutmann)
Date: Tue, 21 Jan 2003 00:10:26 +1300

[email-masked] writes:

>I am interested in hearing from CA operators as to how they would handle this.

In case you can't already predict in advance how I'm going to respond to this
:-), my reaction would be:

- Verify that the CN and email (and possibly other bits, depending on local
  policy) are valid (that is, that the requestor is authorised to use them,
  that they don't duplicate someone else's values, etc etc).

- Issue and publish the cert.

This is going from the basic philosophy that "DNs are a lost cause, so we just
treat them as meaningless blobs with a uniqueness constraint".  This works
just fine in practice.

Peter.

---

From: Jean-Marc Desperrier <[email-masked]>
Date: Mon, 20 Jan 2003 14:11:17 +0100

>treat them as meaningless blobs with a uniqueness constraint".  This works
The japanese report on their PKI Challenge shows some interesting ugly 
results of CA accepting names without proper validation.