Subject: Re: Options for pkinit KDC certificate identification

From: Leif Johansson <[email-masked]>
Date: Tue, 08 Mar 2005 00:45:53 +0100

<snip>

> The working group needs to choose between unambiguous certificates and
> certificates that can be issued without support for a new EKU or
> otherName; we can't have it both ways.
> 

There is a big difference between having support for an EKU and a new
OtherName. One requires code, the other does not. In (say) the openssl
case adding an EKU involves editing a configuration file. Other ca
implementations I have come across behave in a similar way.

I would advocate dNSName + <new EKU>.

> 
> Keep in mind that if a CA is concerned about a particular certificate
> being confused between Kerberos and some other application,
> non-Kerberos uses of that name can be issued a certificate with an
> EKU.

So are you advocating the semantic "no EKU" == Kerberos use?

	MVH leifj