Subject: Is eMail address in SubjectAltName still necessary

From: <[email-masked]>
Date: Tue, 30 Jan 2007 08:39:03 +0100

Hello

We issue among others certificates for secure email to the public. Our
standard profile uses the email field according RFC 3280. We came to the
conclusion that all newer email implementation can handle email addresses in
the subject field a email. 

We are now in the process of implementing a automatic interface by means of
CMP (RFC 2510). The product attached and tested requests the email in the
certificate extension SubjectAltName. By browsing around I came across RFC
3850 where is stated:

3. Using Distinguished Names for Internet Mail 
End-entity certificates MAY contain an Internet mail address as described in
[RFC-2822 </rfcs/rfc2822.html> ]. The address must be an "addr-spec" as
defined in Section 3.4.1 of that specification. The email address SHOULD be
in the subjectAltName extension, and SHOULD NOT be in the subject
distinguished name. 

My question:
- What is the current standard for implementing email addresses in a X.509
v3 certificate?
- Is the RFC 822 email address in the SubjectAltName still required or just
optional for legacy

Thanks

Lorenz

---

From: "Peter Hesse" <[email-masked]>
Date: Tue, 30 Jan 2007 08:11:33 -0500

Lorenz,
 
See this in RFC 3850:

   End-entity certificates MAY contain an Internet mail address as

   described in [RFC-2822].  The address must be an "addr-spec" as

   defined in Section 3.4.1 of that specification.  The email address

   SHOULD be in the subjectAltName extension, and SHOULD NOT be in the

   subject distinguished name.
and this in RFC 3280:

4.1.2.6  Subject
   ...
   Conforming implementations generating new certificates with

   electronic mail addresses MUST use the rfc822Name in the subject

   alternative name field (section 4.2.1.7) to describe such identities.

   Simultaneous inclusion of the EmailAddress attribute in the subject

   distinguished name to support legacy implementations is deprecated

   but permitted.
RFC822 address in subject alternative name is the current, preferred method
of putting email addresses in certificates.  Email address in the subject
name is optional for legacy.
 
--Peter
 
+----------------------------------------------------------------+
| Peter Hesse                     [email-masked]     |
| Phone: 703-378-5808 x105      Gemini Security Solutions, Inc.  |
|       Visit our InfoSecurity blog: securitymusings.com
<http://www.securitymusings.com/>          |
+----------------------------------------------------------------+
"The generation of random numbers is too important to be left
 to chance." --Robert R. Coveyou

  _____  

From: [email-masked] [mailto:[email-masked]] On
Behalf Of [email-masked]
Sent: Tuesday, January 30, 2007 2:39 AM
To: [email-masked]
Subject: Is eMail address in SubjectAltName still necessary

Hello 

3. Using Distinguished Names for Internet Mail 
End-entity certificates MAY contain an Internet mail address as described in
[ <file:///rfcs/rfc2822.html> RFC-2822]. The address must be an "addr-spec"
as defined in Section 3.4.1 of that specification. The email address SHOULD
be in the subjectAltName extension, and SHOULD NOT be in the subject
distinguished name. 

My question: 

Thanks 

Lorenz

---

From: Stephen Kent <[email-masked]>
Date: Tue, 30 Jan 2007 09:02:28 -0500

At 8:39 AM +0100 1/30/07, <[email-masked]> wrote:
>Hello
>
>We issue among others certificates for secure email to the public. 
>Our standard profile uses the email field according RFC 3280. We 
>came to the conclusion that all newer email implementation can 
>handle email addresses in the subject field a email.
>
>We are now in the process of implementing a automatic interface by 
>means of CMP (RFC 2510). The product attached and tested requests 
>the email in the certificate extension SubjectAltName. By browsing 
>around I came across RFC 3850 where is stated:
>
>described in [<file:///rfcs/rfc2822.html>RFC-2822]. The address must 
>be an "addr-spec" as defined in Section 3.4.1 of that specification. 
>The email address SHOULD be in the subjectAltName extension, and 
>SHOULD NOT be in the subject distinguished name.
>
>My question:
>- What is the current standard for implementing email addresses in a 
>X.509 v3 certificate?
>- Is the RFC 822 email address in the SubjectAltName still required 
>or just optional for legacy
>
>Thanks
>
>Lorenz

Lorenz,

The situation is really the opposite of what you ask in your last 
question, i.e., putting an e-mail address in the Subject DN is the 
legacy approach. RFC 3280 strongly prefers putting an e-mail address 
in the SAN over putting it in the Subject DN.

Steve