Subject: Question on ns* cert type deprecation

From: Alan Sill <[email-masked]>
Date: Wed, 3 Jan 2007 14:41:59 -0600

> 2.4.4 nsCertType, nsComment, nsPolicyURL, nsRevocationURL
> The ns* attributes are deprecated and SHOULD NOT be included in any  
> new CA
> certificates.
> If they are included, though, these extensions MUST NOT be marked  
> critical.

Is this for CA certs only (i.e., ones used to identify a CA), or does  
it apply to end-entity certificates issued by a CA to identify a host  
or person also?

We have conditions in which a host may need to contact a service to  
request information, and for which we have been using a Netscape Cert  
Type of SSL Client to indicate that the host is allowed to do so.  I  
am assuming that the above extract from the IETF Certificate Profile  
document is intended to apply to CA certs only, and so our use of  
this field in EE certs is OK.  Or is there a more general way to do  
this?

Thanks,
Alan

====================================================================
:  Alan Sill, Texas Tech University  Office: Admin 233, MS 4-1167  :
:  e-mail: [email-masked]   ph. 806-742-4350  fax 806-742-4358  :
====================================================================

---

From: "David A. Cooper" <[email-masked]>
Date: Mon, 08 Jan 2007 16:08:56 -0500

Alan,

I did an on-line search for the text that you mentioned and could only 
find it in one place:  Grid Certificate Profile.

The IETF PKIX Certificate and CRL Profile does not mention nsCertType, 
nsComment, nsPolicyURL, or nsRevocationURL at all.  Furthermore, on-line 
searches for each of these four terms on the ietf.org web site came up 
with no matches.

So, unless the certificates you are issuing will be used in an 
environment in which conformance with the Grid Certificate Profile is 
important (or required), then the text quoted below is not relevant.  If 
it is relevant, then your concerns need to be addressed to a different 
forum.

Dave

Alan Sill wrote:
> document is intended to apply to CA certs only, and so our use of this 
> field in EE certs is OK.  Or is there a more general way to do this?
>
> Thanks,
> Alan