Subject: Closing issue 08: Certificate details review by Pasi and Valtteri

From: Pekka Nikander <[email-masked]>
Date: Wed, 15 Oct 2003 15:08:59 +0300

I have now processed the subissues in issue #08, and acted
mostly as James suggested in his message on Sep 15th.

Some specific comments:

> Issue 8a:
> "The certificate transport is relatively straight-forward, but the
> description of certificate chains could benefit from some clarifications and
> examples showing at least one valid certificate chain."
> 
> Suggested resolution:
> Since jak has been primarily been handling certificates, he will try to come
> up with an example.

So far I haven't received any examples.  James, could you produce
one today?  I need to have the example by Friday morning my time
to get it included.   If not possible, I guess we need to leave
addition of any such examples for the -01 version of the draft.

> Issue 8d:
> "o  Section 6.3 (editorial): In PKIX-speak, the correct term would probably
> be 'trust anchor', not 'trusted root'."
> 
> Suggested resolution: Jari has said in an initial followup email that he
> will make the change.

I performed a global replace for this, even renaming the Trusted Root
option as Trust Anchor option.  The document doesn't contain the word
"root" any more.

> Issue 8e:
> "o  Sections 6.3 and 6.6 (technical): Presumably, the 'trusted root' should
> contain the issuer of the first certificate in the chain But for X.509
> certs, that's a Distinguished Name, not FQDN.  So should the "trusted root"
> option contain a DER-encoded Issuer DN instead of FQDN?
> 
> Using AltSubjectName (correct spelling is subjectAltName, BTW) seems to make
> it more difficult for the router to decide which certificate to send, since
> its own certificate doesn't necessarily have the CA's dNSName (though it may
> be included in issuerAltName extension).
...
> Suggested resolution: These issues are superceded by use of
> draft-ietf-pkix-x509-as-extn.

Actually the trust anchor name issue is not superceded.  The document
now allows both FQDM and DER-encoded X.509 Name, as requested by Jon
Wood yesterday.

Unless there are any more comments, I will consider this issue
to close together with issue #20.

--Pekka Nikander

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Wed, 15 Oct 2003 10:11:45 -0700

> addition of any such examples for the -01 version of the draft.

Won't have time today. Sorry. We will need to wait for the 01 draft.

            jak