Subject: Re: Wildcard certificates

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sat, 31 Aug 2002 23:52:12 -0700

"William I. Bormann" <[email-masked]> wrote:
> 1. Using dc in place of cn is probably the more correct
> approach to naming the subject of a server certificate,
> viz., for *.foo.bar.com, use dc=*,dc=foo,dc=bar,dc=com
> instead of cn=*.foo.bar.com. 

I note that RFC 2247 (as well as RFC 1274), which defines DC,
constrains it value to a domain component.  "*" is not a domain
component.  Even if "*" were allowed, it wouldn't have any
wildcard semantics.  That is, the DN "DC=*,DC=foo,DC=BAR,DC=COM"
is the (purported) name of one entry, not many.

In my opinion, the dNSname wildcard (ab)use is a far better,
and more widely supported, than DC (ab)use.  I would prefer
revising the applicable technical specifications to allow
dNSName=*.foo.bar.com wildcarding.   Most LDAP/TLS implementations
support dNSName wildcarding (as RECOMMENDED in RFC 2830).

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 01 Sep 2002 12:57:08 -0700

Eric said:
> As Steve Kent points out, dNSNames cannot contain *s.
> However, since CN is the standard place to put the DNS name
> (much to everyone's unhappiness) they often contain *s. Don't
> know if anyone actually uses dNSName for this. 

Most LDAP implementations do this... per RFC 2830, Section 3.6.

Kurt