Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 17:15:50 -0700

Jeffrey Hutzelman wrote:
> We run into those issues anyway for TD-TRUSTED-CERTIFIERS and
AD-INITIAL-> 
> VERIFIED-CAS.

No, my assumption is the subject DN is always present for the CA
certificate.

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 5:12 PM
To: Liqiang(Larry) Zhu; [email-masked]
Cc: [email-masked]; Stefan Santesson; [email-masked]
Subject: RE: What's in a Name?

On Thursday, July 14, 2005 04:53:54 PM -0700 "Liqiang(Larry) Zhu" 
<[email-masked]> wrote:

> Then we will run into issues the subject DN is optional, then the
> character set/UFT8 issue etc.

We run into those issues anyway for TD-TRUSTED-CERTIFIERS and 
AD-INITIAL-VERIFIED-CAS.  Of course, we needn't say much about the 
character sets, since we're deferring to other documents on what 
certificates can or cannot contain.

> It is easy for me to make such a change; I just want to make sure such
> change is blessed by the working group and it can not delay the PKINIT
> draft, that is we need to have a solid proposal first.

The proposal is that we rip out the text (in 2 places, AFAIK) saying
that 
TD-INVALID-CERTIFICATES can only mention certs sent by the client, and
then 
proceed with defining the type on the basis that it might refer to certs

the client doesn't have.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 14 Jul 2005 20:22:45 -0400

> No, my assumption is the subject DN is always present for the CA

OK, so we don't run into the "Name not present" for TD-TRUSTED-CERTIFIERS.
What about AD-INITIAL-VERIFIED-CA's?  I don't remember; does that include 
the leaf cert or only the CA's?

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 15 Jul 2005 09:14:35 -0500

> the leaf cert or only the CA's?

They are all CA certs.