Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 13:36:41 -0700

Nicolas Williams wrote:
> The Name should be there if the client didn't send the whole cert
chain.

On page 10, it says:

   Note that the TD_INVALID_CERTIFICATES error data is only used to
   identify invalid certificates sent by the client in the request.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 1:30 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 03:29:34PM -0500, Nicolas Williams wrote:
> On Thu, Jul 14, 2005 at 01:25:41PM -0700, Liqiang(Larry) Zhu wrote:
> > > TD-INVALID-CERTIFICATES  REQUIRED*  REQUIRED         OPTIONAL
> > 
> > Why the DN is required for TD-INVALID-CERTIFICATES? The client has
the
> > whole certificate, and can find out the name byitself.
> 
> Agreed.  A CHOICE of SubjectKeyIdentifier or IssuerAndSerial should do
> for TD-INVALID-CERTIFICATES.

Oops, I don't agree.

Sorry, I sent that out too quickly.

The Name should be there if the client didn't send the whole cert chain.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 15:42:37 -0500

>    identify invalid certificates sent by the client in the request.

A change made in -26.  Did we have consensus on that change?  I don't
recall.

If a cert in the chain not sent by the client could not be validated
should the client find out the name of it?

Nico
--