Subject: RE: What's in a Name?

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 14 Jul 2005 13:52:27 -0700

Here is the history of it, please go to the mail archive to find this.

Martin complained about this fact is only specified in the comments (see
below) that the TD-INVALID-CERTIFICATES is only for the certificates
sent by client.

       TD-INVALID-CERTIFICATES ::= SEQUENCE OF OCTET STRING
                   -- Each OCTET STRING contains a CMS type
                   -- IssuerAndSerialNumber encoded according to
                   -- [RFC3852].
                   -- Each IssuerAndSerialNumber identifies a
                   -- certificate (sent by the client) with an invalid
                   -- signature.

I then repeated the comment in the main text in -26.

There is no change of semantics, only clarifications were added for
existing text.

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Thursday, July 14, 2005 1:43 PM
To: Liqiang(Larry) Zhu
Cc: Jeffrey Hutzelman; [email-masked]; [email-masked]
Subject: Re: What's in a Name?

On Thu, Jul 14, 2005 at 01:36:41PM -0700, Liqiang(Larry) Zhu wrote:
> 
> Nicolas Williams wrote:
> > The Name should be there if the client didn't send the whole cert
> chain.
> 
> On page 10, it says:
> 
>    Note that the TD_INVALID_CERTIFICATES error data is only used to
>    identify invalid certificates sent by the client in the request.

A change made in -26.  Did we have consensus on that change?  I don't
recall.

If a cert in the chain not sent by the client could not be validated
should the client find out the name of it?

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 14 Jul 2005 16:10:13 -0500

> Here is the history of it, please go to the mail archive to find this.

Got it.