Subject: RE: PI: 10: draft-ietf-pkix-pi-10.txt - single serialNumber attribute

From: "Fisher, James L." <[email-masked]>
Date: Thu, 22 Jul 2004 07:18:22 -0400

> Russ's "problem" DN does not need to be solved.  As David notes, an
attribute type is not allowed to appear more than once in an RDN.

But we frequently see DNs containing multiple "dc=" and "ou="
attributes.  Are those certs in violation of RFC3280 since Section
4.1.2.6 references to X.501 names?

---

From: "David P. Kemp" <[email-masked]>
Date: Thu, 22 Jul 2004 08:50:56 -0400

James,

A "Relative Distinguished Name" (RDN) references one element
or object in a tree, like a single "folder" in a Windows
file pathname.  But unlike a folder name, an RDN may contain
more than one attribute as long as they all have different
types. [ cn="John Smith" sn=12345 ] is a single RDN with two
names, whereas [ cn="John Smith", sn=12345 ] (note the comma)
is two RDNs each with a single name.

A Distinguished Name (DN) is a full path through the tree.
There may be multiple DC= or OU= attributes at different
levels in the tree, but only one at a given level.

Dave