Subject: Re: [pkix] purpose of LDAP in PKI

From: Peter Gutmann <[email-masked]>
Date: Mon, 18 Feb 2013 14:25:48 +0000

"Goulet, Walter" <[email-masked]> writes:

>Basically, exposing your certificate via LDAP makes it *much* easier for
>other applications to actually use your certificate.

This should really be:

  Basically, exposing your certificate makes it *much* easier for other
  applications to actually use your certificate.

The built-in assumption in the original statement that LDAP is the only way to
do this is at best incorrect, at worst dangerous (it implies that you need to
LDAP-enable an application, configure and run an LDAP server, and get things
to talk LDAP to each other, which can be enough to sink a PKI project).

Peter.

---

From: Ferda Topcan <[email-masked]>
Date: Mon, 18 Feb 2013 16:46:25 +0200 (EET)

Actually we do not need to publish signer certificate publicly. Because
signer certificate can be obtained from signature package as defined in
PKCS#7. 

But in case of mobile signature signer certificate needs to be published.
Because signer certificate is not available in SIM card. And signature
creation application needs the signer certificate before signing process
to construct the ESS-Signing-Certificate attribute. 

Ferda TOPCAN
................................................................

 <http://www.tubitak.gov.tr/>  

Disclaimer <http://www.tubitak.gov.tr/disclaimer> 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Peter Gutmann
Sent: Monday, February 18, 2013 4:26 PM
To: [email-masked]
Subject: Re: [pkix] purpose of LDAP in PKI

This should really be:

The built-in assumption in the original statement that LDAP is the only
way to
do this is at best incorrect, at worst dangerous (it implies that you need
to
LDAP-enable an application, configure and run an LDAP server, and get
things
to talk LDAP to each other, which can be enough to sink a PKI project).

Peter.
_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix