Subject: [pkix] URI Name Constraint and URN

From: Santosh Chokhani <[email-masked]>
Date: Tue, 26 Mar 2013 17:46:35 -0400

I have been wrestling with what one should with a certificate if the SAN in the certificate contains URN and when you get to the certificate, the name constraint state variable indicates permitted and/or excluded values for the URI name form.

I think name constraint is not applicable to URN since it does not have an "authority" and thus "host" component by definition.  Thus, regardless of the name constraint state variable, presence of URN should not cause name constraint violation.

But, when I read 5280, I find the text implying otherwise or ambiguous.

Santosh Chokhani
CygnaCom Solutions, Inc.

---

From: "David A. Cooper" <[email-masked]>
Date: Tue, 26 Mar 2013 18:03:58 -0400

Santosh,

Here is what RFC 5280 says:

For URIs, the constraint applies to the host part of
the name.  The constraint MUST be specified as a fully qualified
domain name and MAY specify a host or a domain.  Examples would
be "host.example.com" and ".example.com".  When the constraint
begins with a period, it MAY be expanded with one or more
labels.  That is, the constraint ".example.com" is satisfied by
both host.example.com and my.host.example.com.  However, the
constraint ".example.com" is not satisfied by "example.com".
When the constraint does not begin with a period, it specifies a
host.  If a constraint is applied to the
uniformResourceIdentifier name form and a subsequent
certificate includes a subjectAltName extension with a
uniformResourceIdentifier that does not include an authority
component with a host name specified as a fully qualified
domain name (e.g., if the URI either does not include an
authority component or includes an authority component in
which the host name is specified as an IP address), then the
application MUST reject the certificate.

This seems to quite unambiguously say that the application MUST
reject the certificate.

On 03/26/2013 05:46 PM, Santosh Chokhani wrote:

I have been wrestling with what one should
with a certificate if the SAN in the certificate contains URN
and when you get to the certificate, the name constraint state
variable indicates permitted and/or excluded values for the
URI name form.

I think name constraint is not applicable
to URN since it does not have an “authority” and thus “host”
component by definition.  Thus, regardless of the name
constraint state variable, presence of URN should not cause
name constraint violation.

But, when I read 5280, I find the text
implying otherwise or ambiguous.

Santosh Chokhani

CygnaCom Solutions, Inc.

---

From: "Piyush Jain" <[email-masked]>
Date: Tue, 26 Mar 2013 15:06:58 -0700

>From 5280

(e.g., if the URI either

   does not include an authority component or includes an authority

   component in which the host name is specified as an IP address), then

   the application MUST reject the certificate.

It clearly says that if authority component is missing, certificate must be
rejected.

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Santosh Chokhani
Sent: Tuesday, March 26, 2013 2:47 PM
To: 'pkix'
Subject: [pkix] URI Name Constraint and URN

I have been wrestling with what one should with a certificate if the SAN in
the certificate contains URN and when you get to the certificate, the name
constraint state variable indicates permitted and/or excluded values for the
URI name form.

I think name constraint is not applicable to URN since it does not have an
"authority" and thus "host" component by definition.  Thus, regardless of
the name constraint state variable, presence of URN should not cause name
constraint violation.

 

Santosh Chokhani

CygnaCom Solutions, Inc.