[pkix] Name constraints on domain name in common name
Matt McCutchen <matt@mattmccutchen.net> Fri, 19 March 2010 22:43 UTC
Return-Path: <matt@mattmccutchen.net>
X-Original-To: pkix@core3.amsl.com
Delivered-To: pkix@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 469963A697F for <pkix@core3.amsl.com>; Fri, 19 Mar 2010 15:43:20 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.501
X-Spam-Level:
X-Spam-Status: No, score=-0.501 tagged_above=-999 required=5 tests=[AWL=-0.520, BAYES_05=-1.11, DNS_FROM_OPENWHOIS=1.13]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H9beU4FPBv4W for <pkix@core3.amsl.com>; Fri, 19 Mar 2010 15:43:19 -0700 (PDT)
Received: from homiemail-a10.g.dreamhost.com (caiajhbdcaib.dreamhost.com [208.97.132.81]) by core3.amsl.com (Postfix) with ESMTP id 4B4C73A67CC for <pkix@ietf.org>; Fri, 19 Mar 2010 15:43:19 -0700 (PDT)
Received: from [192.168.1.41] (pool-96-231-11-166.washdc.east.verizon.net [96.231.11.166]) by homiemail-a10.g.dreamhost.com (Postfix) with ESMTPA id 77519280058 for <pkix@ietf.org>; Fri, 19 Mar 2010 15:43:32 -0700 (PDT)
From: Matt McCutchen <matt@mattmccutchen.net>
To: pkix@ietf.org
Content-Type: text/plain; charset="UTF-8"
Date: Fri, 19 Mar 2010 18:43:31 -0400
Message-ID: <1269038611.1755.45.camel@mattlaptop2.local>
Mime-Version: 1.0
X-Mailer: Evolution 2.28.4
Content-Transfer-Encoding: 7bit
Subject: [pkix] Name constraints on domain name in common name
X-BeenThere: pkix@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: PKIX Working Group <pkix.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/pkix>
List-Post: <mailto:pkix@ietf.org>
List-Help: <mailto:pkix-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/pkix>, <mailto:pkix-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 Mar 2010 22:43:20 -0000
The Mozilla community has recognized that to be effective, name constraints must apply to the common name field when it is being used to hold the domain name of a TLS server (a legacy practice): https://bugzilla.mozilla.org/show_bug.cgi?id=394919 RFC 5280 does not mention this issue. We're currently trying to decide under what circumstances to accept a certificate that is subject to a name constraint and has a common name but no dNSName subjectAltNames. Suggestions would be very welcome. -- Matt
- [pkix] Name constraints on domain name in common … Matt McCutchen
- Re: [pkix] Name constraints on domain name in com… Stephen Kent
- Re: [pkix] Name constraints on domain name in com… Matt McCutchen
- Re: [pkix] Name constraints on domain name in com… Santosh Chokhani
- Re: [pkix] Name constraints on domain name in com… Matt McCutchen
- Re: [pkix] Name constraints on domain name in com… Miller, Timothy J.
- Re: [pkix] Name constraints on domain name in com… Matt McCutchen
- Re: [pkix] Name constraints on domain name in com… Kemp, David P.
- Re: [pkix] Name constraints on domain name in com… Geoff Beier
- Re: [pkix] Name constraints on domain name in com… Tom Gindin
- Re: [pkix] Name constraints on domain name in com… Stefan Santesson
- Re: [pkix] Name constraints on domain name in com… Jean-Marc Desperrier
- Re: [pkix] Name constraints on domain name in com… Stefan Santesson