Subject: RE: ticket 839: trustedCertifiers

From: "Paul Leach" <[email-masked]>
Date: Sun, 20 Mar 2005 16:39:28 -0800

Are we just quibbling over a SHOULD?

The KDC SHOULD send back a cert that chains to one of the
trustedCertifiers if it has one?

I think that's implied by saying that the trustedCertifiers are hints
(one SHOULD always take hints into account), but if you want to make it
explicit, fine by me.

---

From: Sam Hartman <[email-masked]>
Date: Sun, 20 Mar 2005 20:50:53 -0500

>>>>> "Paul" == Paul Leach <[email-masked]> writes:

    Paul> Are we just quibbling over a SHOULD?  The KDC SHOULD send
    Paul> back a cert that chains to one of the trustedCertifiers if
    Paul> it has one?

I'd agree with this.

    Paul> I think that's implied by saying that the trustedCertifiers
    Paul> are hints (one SHOULD always take hints into account), 

Ah, this is not what hints mean to me at all.  Hints could for example
be things like type 1 font scaling hints--things that a good
implementation will take into account but a crappy implementation need
not care about.

    Paul> but
    Paul> if you want to make it explicit, fine by me.