Subject: (Un)managing non-existent DNs in enrolments

From: [email-masked]
Date: Mon, 20 Jan 2003 10:44:18 +0000

During the recent interop trials on the PKI Challenge we had some first-hand
experience of the implications for PKI in persisting with a non-global DN
space.

We knew that there would be some insurmountable Directory issues but
we tried to mitigate the problems by prescribing a DIT and naming structure
for the project. Even so not everybody involved in the trials stuck to the spec.
Hardly surprising given the prevailing economic conditions that the project
was working with. One of the more interesting outcomes of the trials was that
enrolment requests from domains with alien DITs could not be published.
The requested DN was not valid within the DIT for the CA performing the
enrolment. While this meant that the EE cert could not be  browsed it also
meant that the published credentials could not be managed by any tool that
used the Directory as its source of reference. Thus, such tools could not
revoke the certificates that its own CA had published.

Clearly these are not protocol issues as such but it does pose some
serious questions about how a CA should handle an enrolment request
that includes a non-existent DN. Should it;

i) Reject it because it's against the CP
ii) Accept the DN and extend the DIT to accommodate (dangerous)
iii) Override the DN and publish to a catch-all bin
iv) Publish under the lowest possible policy

I am interested in hearing from CA operators as to how they would handle this.

Chris

This  email  and  any  attachments  are confidential and intended for the addressee
only.   If  you are not the named recipient, you must not use, disclose, reproduce,
copy  or  distribute the contents of this communication.  If you have received this
in error, please contact the sender and then delete this email from your system.