Subject: CONSENSUS call - subjectAltName/otherName constraints

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 12 Nov 2004 11:57:31 -0500

This is ticket #526.

Love brought up an issue with not being able to set constraints on 
subjectAltName/otherName, which could cause problems with restricting what 
principals a CA can issue certs for.

This was discussed extensively at the meeting in Washington, and it was 
determined that because such constraints are critical, a constraint type 
can be defined and used in the future, without any need for a change to 
PKINIT today.

Therefore, it was decided that nothing needs to be done to PKINIT for this 
issue.

Now, we need to validate this decision on the mailing list.  To that end, I 
will accept comments on this issue until Friday, November 19.  Hopefully by 
that point I'll be able to declare a consensus.

-- Jeff

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 30 Nov 2004 18:25:35 -0500

On Friday, November 12, 2004 11:57:31 -0500 Jeffrey Hutzelman 
<[email-masked]> wrote:

> subjectAltName/otherName, which could cause problems with restricting
> what principals a CA can issue certs for.
>
> Therefore, it was decided that nothing needs to be done to PKINIT for
> this issue.
>
> Now, we need to validate this decision on the mailing list.  To that end,
> I will accept comments on this issue until Friday, November 19.
> Hopefully by that point I'll be able to declare a consensus.

This issue was discussed extensively at the meeting in Washington, and many 
of the most active participants were present during that discussion.  Both 
the key points of that discussion and the subsequent poll were reported in 
the minutes of that meeting.  In such a situation, I believe that the 
resulting decision can be validated without having the discussion over 
again here, provided that, as in this case, there have been no objections.

Therefore, I am declaring that it is the consensus of the WG that no 
further changes need to be made to PKINIT to address this issue, and I am 
closing the corresponding ticket.

-- Jeff