Subject: [AAA-WG]: Issue 16: Redirect Server Certificates

From: Pat Calhoun <[email-masked]>
Date: Sat, 30 Jun 2001 16:26:18 -0700

All,

I would like to propose how to resolve this issue. Essentially, what
this issue is all about is the ability for a redirect server
to return certificates for all hosts in a domain. However, there were
some folks that wanted all servers to share the same certificate, since 
it is not know to which server a request will be destined.

So, to solve this problem, I propose adding the following methods in 
the cms draft:
1. it is possible for a redirect server to return a cert per server in
   the domain.
2. it is possible for the fqdn of all servers in the domain to have their
   identity encoded in the altSubjectName of the cert. So, many servers
   would be encoded in the cert.

Are folks comfortable with this approach?

PatC