Subject: RE: Do we need KRB5PrincipalName name constraints in PKINIT

From: "Paul Leach" <[email-masked]>
Date: Fri, 9 Sep 2005 18:27:00 -0700

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Friday, September 09, 2005 12:44 PM
To: Stefan Santesson

Speaking as an individual, I am uncomfortable with a dnsname constraint
because we are not
suggesting that people use or support dnsnames to name their realms.
[Paul Leach] It isn't necessary that we suggest that they use DNS names
to name their realms in order to suggest that _if_ they happen to name
their realms with DNS names they might want to use dNSName SAN in their
KDC certs and also use name constraints on the dNSName SAN.

Especially since quite a lot of people in fact use DNS names for their
realms.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 12 Sep 2005 00:33:38 -0400

On Friday, September 09, 2005 18:27:00 -0700 Paul Leach 
<[email-masked]> wrote:

> KDC certs

<chair hat on>
Except that we've already decided not to say this...

> and also use name constraints on the dNSName SAN.

<chair hat off>
So I don't think we should say this either.

> Especially since quite a lot of people in fact use DNS names for their

No one suggested otherwise.  Sam wasn't talking about realms with DNS-style 
realm names; he was talking about KDC certificates with the dnsName SAN, 
which is not something described by PKINIT.

-- Jeff