Subject: Fwd: Re: A comment on certificate-based server authentication and multiple DNS names

From: RJ Atkinson <[email-masked]>
Date: Wed, 06 Sep 2000 12:48:32 -0400

>From: [email-masked]
>Subject: Re: A comment on certificate-based server authentication and multiple DNS
> names
>Keywords: 
>To: [email-masked]
>X-Mailer: Lotus Notes Release 5.0.2c (Intl) 2 February 2000
>Date: Wed, 6 Sep 2000 14:53:20 +0000
>X-MIMETrack: Serialize by Router on OZ-ICE/OZ-Inc(Release 5.0.3 (Intl)|21 March 2000) at
> 06.09.2000 14:53:51
>Sender: [email-masked]
>
>Neils wrote:
>>PS. Your mail looked quite anonymous, with a from address of
>>"[email-masked]" and no name or .signature. I can't say if that a
>>clinet.fi mailing-list problem, a Lotus Notes problem, or a local
>>oz.is configuration error?

Anonymous correspondent wrote:
>  How quaint. I don't use a signature, but the from address 
>should be correct.

Not even.  Full headers from your email are prepended 
to the top of this email.  It looks like maybe a Lotus Notes 
bug or an MTA weirdness.  Any road, a signature (formal or
informal) would be helpful given what's happening to the
headers. :-)

Ran
[email-masked]

---

From: Ssh Mailing List Administrator <[email-masked]>
Date: Wed, 13 Sep 2000 14:17:10 +0200

--------------- On 12.09.2000 22:45:32 owner-ietf-ssh wrote:
---------------
>>   HTTPS has a big problem with #3 because they can not present multiple
>> names with the same certificate. As SecSH does not yet deal in
certificates,
>> I suggest that the problem should be solved at that point.
>
>There is "insert certificate here" text in the current set of drafts.
>
>                        - Bill
>
  I'd like to draw your attention to section 4.6, "Public Key Algorithms",
of the current transport document draft
("draft-ietf-secsh-transport-07.txt"). This section lists several "Public
Key Algorithms" that an implementation MAY support, among which is X.509
which is a certificate format. It even goes as far as specifying the binary
format for an X.509 certificate, although it fails to specify which - if
any - attributes of the certificate are to be used to certify which - if
any - facts about the holder of the corresponding private key.

BTW: I don't think that the fact that https/TLS isn't able to deal with
multiple certificates in the single-IP multiple-names case, is valid
justification for why SSH doesn't need to do so. One should generally
strive to learn from past mistakes rather than to repeat them.
---
Sigurdur Asgeirsson
[email-masked]

---

From: Ssh Mailing List Administrator <[email-masked]>
Date: Thu, 14 Sep 2000 15:25:17 +0200

certificates,