Subject: RE: Sample end entity certificate

From: "Scott Shorter" <[email-masked]>
Date: Wed, 10 Jan 2007 06:02:40 -0800

Hi,

Folks who use Outlook will have the certificate stripped, you might want
to zip it before attaching it, or change the filename to ivpk.ce_

Regards,
Scott 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Moudrick 
> M. Dadashov
> Sent: Tuesday, January 09, 2007 8:06 PM
> To: [email-masked]
> Subject: Sample end entity certificate
> 
> Hello,
> 
> I'm attaching a sample end entity cetrificate that the 
> issuing CA claims to be RFC 3280 compliant.
> 
> The certificate at least MUST provide document signing functionality.
> 
> Some of us say it's technically correct but has no legal 
> purposes defined and therefore can't be used for test 
> purposes only, while others say it's a universial one and can 
> be used for all purposes.
> 
> Any comments are highly appreciated.
> 
> Thank you for your time,
> M.D.
>

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Wed, 10 Jan 2007 16:50:07 +0200 (EET)

Thank you. Attached a renamed copy, as you suggested.

Best Regards,

M.D.

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 11 Jan 2007 09:12:00 +1100

CN=IVPK prie LRV,C=LT,EMAILADDRESS=[email-masked]
The issuer name (above) is poorly chosen. This hierarchical name starts (at the top of the hierarchy) with an email address. The country is a child of the email address.

The email address should be at the other end:
  EMAILADDRESS=[email-masked],CN=IVPK prie LRV,C=LT

Or better still, in the same RDN as the common name (note the plus sign, instead of a comma, separating the CN and EMAILADDRESS components):
  CN=IVPK prie LRV+EMAILADDRESS=[email-masked],C=LT

Or best of all, the email address should be in the issuerAlt.Name extension:
  CN=IVPK prie LRV,C=LT
And
  …{ extnId id-ce-subjectAltName,
    extnValue GeneralNames:{ rfc822Name:" [email-masked]" } }