Subject: Re: [pkix] Amendment to CABF Baseline Requirements

From: Carl Wallace <[email-masked]>
Date: Thu, 06 Apr 2017 12:28:20 -0400

Given these ASN.1 upper bounds are automatically enforced by ASN.1 compiler
generated code, how do we hand wave this away? These changes are a recipe
for interoperability pain.

From:  pkix <[email-masked]> on behalf of Ben Wilson
<[email-masked]>
Date:  Thursday, April 6, 2017 at 12:24 PM
To:  "[email-masked]" <[email-masked]>
Subject:  [pkix] Amendment to CABF Baseline Requirements

> Does anyone want to comment on my draft amendment to the CA/Browser Forum’s
> Baseline Requirements for SSL/TLS Certificates which would remove the
> 64-character limit on the commonName and organizationName,  as an exception to
> RFC 5280?  The text of the relevant Baseline Requirement provision is found
> below with the proposed additional language in ALL CAPS.  The reason for the
> first change (commonName) is there are FQDNs (in Subject Alternative Names)
> that are longer than 64 characters.  The reason for the second change
> (organizationName) is that there are organizations with names longer than 64
> characters.
>  
> 7.1.4.2.2.             Subject Distinguished Name Fields
> a.            Certificate Field: subject:commonName (OID 2.5.4.3)
> Required/Optional: Deprecated (Discouraged, but not prohibited)
> Contents: If present, this field MUST contain a single IP address or
> Fully-Qualified Domain Name that is one of the values contained in the
> Certificate’s subjectAltName extension (see Section 7.1.4.2.1).
> MAXIMUM LENGTH:  NO STIPULATION.  (THIS IS AN EXCEPTION TO RFC 5280 WHICH
> SPECIFIES AN UPPER BOUND OF 64 CHARACTERS.)
> b.            Certificate Field: subject:organizationName (OID 2.5.4.10)
> Optional.  
> Contents: If present, the subject:organizationName field MUST contain either
> the Subject’s name or DBA as verified under Section 3.2.2.2. The CA may
> include information in this field that differs slightly from the verified
> name, such as common variations or abbreviations, provided that the CA
> documents the difference and any abbreviations used are locally accepted
> abbreviations; e.g., if the official record shows “Company Name Incorporated”,
> the CA MAY use “Company Name Inc.” or “Company Name”.  Because Subject name
> attributes for individuals (e.g. givenName (2.5.4.42) and surname (2.5.4.4))
> are not broadly supported by application software, the CA MAY use the
> subject:organizationName field to convey a natural person Subject’s name or
> DBA.
> MAXIMUM LENGTH:  256 CHARACTERS (THIS IS AN EXCEPTION TO RFC 5280 WHICH
> SPECIFIES AN UPPER BOUND OF 64 CHARACTERS.)
>  
> Thanks,
> Ben Wilson
> _______________________________________________ pkix mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/pkix

---

From: Jeremy Rowley <[email-masked]>
Date: Thu, 6 Apr 2017 16:40:03 +0000

Can you point to any browser software that cares about these limits?  I can’t find any.

From: pkix [mailto:[email-masked]] On Behalf Of Carl Wallace
Sent: Thursday, April 6, 2017 10:28 AM
To: Ben Wilson <[email-masked]>; [email-masked]
Subject: Re: [pkix] Amendment to CABF Baseline Requirements

Given these ASN.1 upper bounds are automatically enforced by ASN.1 compiler generated code, how do we hand wave this away? These changes are a recipe for interoperability pain. 

From: pkix <[email-masked] <mailto:[email-masked]> > on behalf of Ben Wilson <[email-masked] <mailto:[email-masked]> >
Date: Thursday, April 6, 2017 at 12:24 PM
To: "[email-masked] <mailto:[email-masked]> " <[email-masked] <mailto:[email-masked]> >
Subject: [pkix] Amendment to CABF Baseline Requirements

Does anyone want to comment on my draft amendment to the CA/Browser Forum’s Baseline Requirements for SSL/TLS Certificates which would remove the 64-character limit on the commonName and organizationName,  as an exception to RFC 5280?  The text of the relevant Baseline Requirement provision is found below with the proposed additional language in ALL CAPS.  The reason for the first change (commonName) is there are FQDNs (in Subject Alternative Names) that are longer than 64 characters.  The reason for the second change (organizationName) is that there are organizations with names longer than 64 characters.

Contents: If present, this field MUST contain a single IP address or Fully-Qualified Domain Name that is one of the values contained in the Certificate’s subjectAltName extension (see Section 7.1.4.2.1).

MAXIMUM LENGTH:  NO STIPULATION.  (THIS IS AN EXCEPTION TO RFC 5280 WHICH SPECIFIES AN UPPER BOUND OF 64 CHARACTERS.)

Optional.  

Contents: If present, the subject:organizationName field MUST contain either the Subject’s name or DBA as verified under Section 3.2.2.2. The CA may include information in this field that differs slightly from the verified name, such as common variations or abbreviations, provided that the CA documents the difference and any abbreviations used are locally accepted abbreviations; e.g., if the official record shows “Company Name Incorporated”, the CA MAY use “Company Name Inc.” or “Company Name”.  Because Subject name attributes for individuals (e.g. givenName (2.5.4.42) and surname (2.5.4.4)) are not broadly supported by application software, the CA MAY use the subject:organizationName field to convey a natural person Subject’s name or DBA.

MAXIMUM LENGTH:  256 CHARACTERS (THIS IS AN EXCEPTION TO RFC 5280 WHICH SPECIFIES AN UPPER BOUND OF 64 CHARACTERS.)

Thanks,

Ben Wilson

_______________________________________________ pkix mailing list [email-masked] <mailto:[email-masked]>  https://www.ietf.org/mailman/listinfo/pkix

---

From: Carl Wallace <[email-masked]>
Date: Thu, 06 Apr 2017 13:07:51 -0400

Ah, I assumed you had all the browser folks covered and sought broader
comments (hence posting here). If breaking non-browser instances is of no
concern, feel free to ignore my comment.

From:  Jeremy Rowley <[email-masked]>
Date:  Thursday, April 6, 2017 at 12:40 PM
To:  Carl Wallace <[email-masked]>, Ben Wilson
<[email-masked]>, "[email-masked]" <[email-masked]>
Subject:  RE: [pkix] Amendment to CABF Baseline Requirements

> generated code, how do we hand wave this away? These changes are a recipe for
> interoperability pain.
> 
>  
> 
>> 64-character limit on the commonName and organizationName,  as an exception
>> to RFC 5280?  The text of the relevant Baseline Requirement provision is
>> found below with the proposed additional language in ALL CAPS.  The reason
>> for the first change (commonName) is there are FQDNs (in Subject Alternative
>> Names) that are longer than 64 characters.  The reason for the second change
>> abbreviations; e.g., if the official record shows “Company Name
>> Incorporated”, the CA MAY use “Company Name Inc.” or “Company Name”.  Because
>> Subject name attributes for individuals (e.g. givenName (2.5.4.42) and
>> surname (2.5.4.4)) are not broadly supported by application software, the CA
>> MAY use the subject:organizationName field to convey a natural person
>> Subject’s name or DBA.