Subject: RE: Cert Rqsts and Key Pairs

From: Andrew Probert <[email-masked]>
Date: Mon, 4 Jan 1999 09:24:02 +1100

I have used multiple certs for the same keypaire, where the device was a
Web server, having multiple SSL ports e.g. www1a.site.com,
www1b.site.com, www1c.site.com.  These were virtual IP mapped onto
differing services on the server.

But the hardware crypto engine behind the scenes used the same keys, no
matter which virtual / logical server was used.  This simplified key
management on the SSL server and especially in the hardware crypto.

I'd be interested to hear the context in which you would use a PKIX MIB?

Regards.

Andew Probert
Rotek Consulting   http://www.rotek.com.au
a Division of Secure Network Services
Tel  +61 3 9690 8877
Fax +61 3 9690 8171

> -----Original Message-----
> From:	Eric Bomarsi [SMTP:[email-masked]]
> Sent:	Thursday, December 31, 1998 5:57 AM
> To:	[email-masked]
> Subject:	Cert Rqsts and Key Pairs
> 
> 
> Is there any practical reason why a network device would
> need to generate multiple certificate requests each including
> the same public/private key pair?  Maybe for some reason
> two cert rqsts would include the same key pair, but have
> different distinguished names or extensions?
> 
> I am writing a PKI MIB and need to determine the best way
> for a pkiCertRqstEntry to reference a public/private key-pair:
> 
> 1) include keypair info (algorithm and length) in pkiCertRqstEntry
> such that the keypair is created along with the pkiCertRqstEntry.
> This would limit the key-pair use to the single pkiCertRqstEntry.
> 
> 2) create a separate pkiKeyPairTable where pkiKeyPairEntries
> are referenced by pkiCertRqstEntries:
> 
> 2a) If always 1 pkiCertRqstEntry to 1 pkiKeyPairEntry, then
> I can use the same index for both tables.
> 
> 2b) Otherwise (n pkiCertRqstEntries to 1 pkiKeyPairEntry)
> a different index for the pkiCertRqstTable is necessary.
> 
> Thanks in advance,
> Eric Bomarsi
>

---

From: Eric Bomarsi <[email-masked]>
Date: Mon, 04 Jan 1999 08:37:04 -0500

Thanks Andrew,

A few people have pointed out the need for multiple cert requests
to use the same keypair, so it's clear that the keypair and cert request
tables need to be separate.

RE: I'd be interested to hear the context in which you would use a PKIX
MIB?

The PKI MIB I'm working on is for a VPN Gateway, but could be used for
any networking device which supported PKI.  It currently supports keypair
and cert request generation, loading self and static certificates into the
device,
and a certificate table to manage all certs (self, static, dynamic) in the
local
database.  I plan to add support for CRLs and LDAP client config soon.

/Eric Bomarsi