Subject: RE: [Emu] Multiple identity issue

From: Bernard Aboba <[email-masked]>
Date: Tue, 8 May 2007 15:55:26 -0700

The 3rd paragraph of Section 5.2 says:
 
   Where the subjectAltName field is present in the peer or server   certificate, the Peer-Id or Server-Id MUST be set to the contents of   the subjectAltName.  If subject naming information is present only in   the subjectAltName extension of a peer or server certificate, then   the subject field MUST be an empty sequence and the subjectAltName   extension MUST be critical.  
 
Therefore it would seem that presence of both a single subject and single subjectAltName would not result in export of multiple Peer-Id(s) or Server-Id(s).  This can only happen if there are multiple subjectAltName fields. 
 
So how about: 
 
"It is possible for more than one subjectAltName field to be presentin a peer or server certificate; similarly, it is possible for anon-empty subject name field to also be present in a peer or servercertificate.  Where more than one subjectAltName field is present in a certificate, 
EAP-TLS may export more than one Peer-Id or more than one Server-Id; 
all of the exported Peer-Id(s) and Server-Id(s) are considered valid. "
 
Joe Salowey said: 
> looks good, except I think that there can be only one Subject Name field> in a valid certificate. How about something like: > > "It is possible for more than one subjectAltName field to be present> in a peer or server certificate; similarly, it is possible for a> non-empty subject name field to also be present in a peer or server> certificate. In this case, EAP-TLS may export more than one Peer-Id> or more than one Server-Id; all of the exported Peer-Id(s) and> Server-Id(s) are considered > valid. "> > > ________________________________> > From: Bernard Aboba [mailto:[email-masked]] > Sent: Tuesday, May 08, 2007 2:54 PM> To: [email-masked]> Subject: [Emu] Multiple identity issue> > > At the EMU WG meeting, we discussed the situation where more> than one altsubjectName or subject field are present in a certificate.> Here is some text which can be added to the end of Section 5.2 to> address this issue:> > "It is possible for more than one subjectAltName field to be> present> in a peer or server certificate; similarly, it is possible for> more> than one subject name field to be present in a peer or server> certificate. In this case, EAP-TLS may export more than one> Peer-Id> or more than one Server-Id; all of the exported Peer-Id(s) and> Server-Id(s) are considered > valid. "> > > _______________________________________________> Emu mailing list> [email-masked]> https://www1.ietf.org/mailman/listinfo/emu

_______________________________________________
Emu mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/emu

---

From: "Joseph Salowey \(jsalowey\)" <[email-masked]>
Date: Wed, 9 May 2007 08:47:15 -0700

I think it would be more consistent with RFC 3280 if we report a
non-empty  subject name as well as the subjectAltNames since they all
are valid identities within the certificate.  

> -----Original Message-----
> From: Bernard Aboba [mailto:[email-masked]] 
> Sent: Tuesday, May 08, 2007 3:55 PM
> To: Joseph Salowey (jsalowey); [email-masked]
> Subject: RE: [Emu] Multiple identity issue
> 
>    Where the subjectAltName field is present in the peer or server
>    certificate, the Peer-Id or Server-Id MUST be set to the 
> contents of
>    the subjectAltName.  If subject naming information is 
> present only in
>    the subjectAltName extension of a peer or server certificate, then
>    the subject field MUST be an empty sequence and the subjectAltName
>    extension MUST be critical.  
>  
> Therefore it would seem that presence of both a single 
> subject and single subjectAltName would not result in export 
> of multiple Peer-Id(s) or Server-Id(s).  This can only happen 
> if there are multiple subjectAltName fields. 
>  
> So how about: 
>  
> "It is possible for more than one subjectAltName field to be 
> present in a peer or server certificate; similarly, it is 
> possible for a non-empty subject name field to also be 
> present in a peer or server certificate.  Where more than one 
> subjectAltName field is present in a certificate, EAP-TLS may 
> export more than one Peer-Id or more than one Server-Id; all 
> of the exported Peer-Id(s) and Server-Id(s) are considered valid. "
>  
> 
> Joe Salowey said: 
> 
> > looks good, except I think that there can be only one Subject Name 
> > field in a valid certificate. How about something like:
> > 
> > "It is possible for more than one subjectAltName field to 
> be present 
> > in a peer or server certificate; similarly, it is possible for a 
> > non-empty subject name field to also be present in a peer or server 
> > certificate. In this case, EAP-TLS may export more than one 
> Peer-Id or 
> > more than one Server-Id; all of the exported Peer-Id(s) and
> > Server-Id(s) are considered
> > valid. "
> > 
> > 
> > ________________________________
> > 
> > From: Bernard Aboba [mailto:[email-masked]]
> > Sent: Tuesday, May 08, 2007 2:54 PM
> > To: [email-masked]
> > Subject: [Emu] Multiple identity issue
> > 
> > 
> > At the EMU WG meeting, we discussed the situation where 
> more than one 
> > altsubjectName or subject field are present in a certificate.
> > Here is some text which can be added to the end of Section 5.2 to 
> > address this issue:
> > 
> > "It is possible for more than one subjectAltName field to 
> be present 
> > in a peer or server certificate; similarly, it is possible for more 
> > than one subject name field to be present in a peer or server 
> > certificate. In this case, EAP-TLS may export more than one 
> Peer-Id or 
> > more than one Server-Id; all of the exported Peer-Id(s) and
> > Server-Id(s) are considered
> > valid. "
> > 
> >