Subject: [pkix] RFC 5280 Questionnaire for CAs

From: "David A. Cooper" <[email-masked]>
Date: Mon, 31 Aug 2009 12:13:59 -0400

All,

I am renewing my effort 
(http://www.ietf.org/proceedings/74/slides/pkix-3.pdf) to prepare a 
document to justify advancing the PKIX Certificate and CRL Profile (RFC 
5280) to Draft Standard status.  Based on 
draft-dusseault-impl-reports-04, I feel comfortable that I have found 
sufficient evidence of interoperable implementations of most features in 
RFC 5280 by obtaining certificates and CRLs from TLS protected web 
sites, signed emails, and the U.S. Federal PKI and as a result of 
testing path validation software against PKITS 
(http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html) 
along with some additional testing.

While the set of certificates and CRLs that I was able to locate did not 
cover all of the features in RFC 5280, I am guessing that most of the 
features that I did not locate are supporting by CA implementations, but 
were just not in use in the certificates and CRLs that I found.  So, in 
order to ensure the completeness of the implementation report, I am 
employing the questionnaire approach to obtain information about 
implementation of a few of the features in RFC 5280.

If you have a CA product, you can help me out by answering the questions 
below.  Please let me know the name and version of the product for which 
the information is being provided.

Thanks in advance,

Dave

P.S.  A similar questionnaire for PKI clients will follow in a few minutes.
-----------------------------------------------------------------------

(1) Can the CA create the following name forms in
    the subjectAltName extension as specified in RFC 5280?

    * IPv4 address in iPAddress field
    * IPv6 address in iPAddress field
    * URI in uniformResourceIdentifier field

(2) Can the CA include constraints on the following name
    forms in the nameConstraints extension as specified
    in RFC 5280?

    * IPv4 addresses
    * IPv6 addresses
    * URIs

(3) Can the CA include the subjectDirectoryAttributes
    extension in certificates?

(4) Can the CA issue indirect CRLs?  Have you verified
    that clients developed by other vendors can
    use the CRLs to verify the status of certificates?

(5) Can the CA issue delta-CRLs?  Have you verified that
    clients developed by other vendors can use the
    CRLs to verify the status of certificates?

(6) Can the CA include the subjectInfoAccess extension
    in certificates with the id-ad-timeStamping access method?

(7) Can the CA (or RA) encode internationalized
    domain name names in the dNSName field of
    of GeneralName as specified in Section 7.2
    of RFC 5280?  In the host-part of an
    rfc822Name?

(8) Can the CA (or RA) encode internationalized
    domain name labels in a domainComponent
    attribute as specified in Section 7.3 of
    RFC 5480?

(9) Can the CA (or RA) encode IRIs in the
    uniformResourceIdentifier field of GeneralName
    as specified in Section 7.4 of RFC 5280?