Subject: [sidr] multi-value distinguished name question

From: Stephen Kent <[email-masked]>
Date: Mon, 9 Nov 2009 19:30:12 -0500

Tim Polk asked David Cooper (a NIST colleague) to check on the 
question that was raised during our meeting yesterday morning. The 
question was whether, if we require Subject and Issuer names in X.509 
certs to be either just a CN or a CN plus a serialNumber (as a set), 
one could use commonly available CA software generate certs. The 
answer is that both OpenSSL and an NSS can do this. OpenSSL required 
some configuration effort, but David provided the details of the 
config params in his response!

I will check with someone who knows about OpenCA, to see what they say.

Steve

---

From: Russ Housley <[email-masked]>
Date: Mon, 09 Nov 2009 20:44:53 -0500

Every time I have seen the use of more than one element in the set, 
people get confused, which in turn results in more complexity, at 
least in the user interfaces.  Why accept this complexity?  I'm not 
seeing an offsetting benefit.

Russ

At 07:30 PM 11/9/2009, Stephen Kent wrote:
>question was whether, if we require Subject and Issuer names in 
>X.509 certs to be either just a CN or a CN plus a serialNumber (as a 
>set), one could use commonly available CA software generate certs. 
>The answer is that both OpenSSL and an NSS can do this. OpenSSL 
>required some configuration effort, but David provided the details 
>of the config params in his response!
>
>_______________________________________________
>sidr mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/sidr

---

From: Stephen Kent <[email-masked]>
Date: Mon, 9 Nov 2009 21:00:23 -0500

>seeing an offsetting benefit.

I admit that we could do it either way, but so far we have seen no 
CAs that can't do the set.

If we choose to represent the two attributes (that need not always be 
present) as two RDNs, we would have to decide on the order.

I'm not wedded to the set representation; I just prefer it from a 
semantic perspective.

Steve

---

From: Geoff Huston <[email-masked]>
Date: Tue, 10 Nov 2009 14:59:25 +1100

WG co-chair hat OFF

Steve,

I wonder if  you wiould mind forwarding on such configuration details  
to this list?

Also, this appears to require a documentation change in the res-cert  
draft - is that that case? If so what alternate wording is required  
for the Issuer and subject name section?

regards,

    Geoff

    WG co-chair hat OFF

On 10/11/2009, at 11:30 AM, Stephen Kent wrote:

> question was whether, if we require Subject and Issuer names in X. 
> 509 certs to be either just a CN or a CN plus a serialNumber (as a

---

From: Stephen Kent <[email-masked]>
Date: Tue, 10 Nov 2009 02:13:06 -0500

Geoff,

Here are the details provided by David:

------------------------------
Using OpenSSL 1.0.0-beta3 15 Jul 2009:

openssl req -out sidr.req -newkey rsa:2048 -keyout sidr.key -config 
./openssl.cnf -multivalue-rdn -subj "/CN=SIDR test+serialNumber=4"
openssl ca -in sidr.req -out sidr.pem -config openssl.cnf -preserveDN

NSS 3.12.3:

certutil -N -d temp/
certutil -R -k rsa -g 2048 -s "CN=SIDRtest, dc=example, dc=com" -d 
temp/ -o ta.req
certutil -C -i ta.req -x -d temp/ -o ta.cer -m 0
certutil -A -n "SIDRTA" -t "TC,TC,TC" -d temp/ -i ta.cer
certutil -R -k rsa -g 2048 -s "serialNumber=5+CN=SIDR test" -d temp/ 
-o sidr.req
     certutil -C -c "SIDRTA" -i sidr.req -o sidr_NSS.cer -m 8 -d temp/

----------

As for the rescerts I-D, I don't think it needs to change, because it 
refers to the arch doc for subject and issuer name conventions. 
However, that document is not specific about how to organize the 
common name and serial number attributes when they both appear in a 
Subject or Issuer name.

We have the option to move the details into the cert profile, or put 
more details into the arch doc.

Steve

---

From: Geoff Huston <[email-masked]>
Date: Tue, 10 Nov 2009 20:06:13 +1100

WG co-chair hat off
On 10/11/2009, at 6:13 PM, Stephen Kent wrote:

> openssl req -out sidr.req -newkey rsa:2048 -keyout sidr.key - 
> config ./openssl.cnf -multivalue-rdn -subj "/CN=SIDR test 
> +serialNumber=4"
> As for the rescerts I-D, I don't think it needs to change, because  
> it refers to the arch doc for subject and issuer name conventions.   

And the option to place these details in the resource certificate  
profile document, of course.

Still speaking as an individual, and not a wg co-chair, I'm not sure  
myself where would be the most obvious place to put this, where "most  
obvious" is from the perspective of a future reader / implementor.

regards,

   Geoff

   WG co-chair hat off