Subject: [pkix] purpose of LDAP in PKI

From: "Andris Berzins" <[email-masked]>
Date: Mon, 18 Feb 2013 14:49:47 +0200

Hello,

What could be the reason why end user certificates should be stored in LDAP by the CA and made publicly available?

(I might understand the reason for storing CRLs (LDAP as an alternative to HTTP).)

---

From: "Piyush Jain" <[email-masked]>
Date: Mon, 18 Feb 2013 10:07:46 -0800

Why make user certificate publicly available?

-          Others can look you up and encrypt stuff that the send you without asking you for your certificate.

Why Not?

-          Loss of privacy

Why use ldap?

-          Historical reasons. 

-          Standard schema/attributes exist to store such information

Why not?

-          Scalability issues, complicated setup, difficult to find LDAP experts, subtle differences/idiosyncrasies of ldap implementations make interoperability difficult.

Why use http?

-          Everyone knows http J, scalable

Why not?

-          Standards to store/search for certificates/CRLs in HTTP stores are relatively new and implementations are limited. This is changing though and many big PKI implementations use HTTP to store CA certificates and CRLs. Have not seen any stores http backend that stores user certificates and provides API to search for such  certificates.

From: [email-masked] [mailto:[email-masked]] On Behalf Of Andris Berzins
Sent: Monday, February 18, 2013 4:50 AM
To: [email-masked]
Subject: [pkix] purpose of LDAP in PKI

 

Hello,