Re: [TLS] Verifying X.509 Certificate Chains out of order

[pgut001 at cs.auckland.ac.nz (Peter Gutmann)]

Martin Rex <Martin.Rex at sap.com> writes:

>Would a zero-length ASN.1 SEQUENCE not require that DistinguishedName have a
>zero length?

A zero-length BER encoding of a SEQUENCE would be 30 81 00, which meets the
minimum-length requirements of 3 bytes.

(I'd always assumed that the limit of 3 bytes was specifically to allow this
encoding of an empty DN, since it's not possible to get a DN that fits into 3
bytes).

Peter.
_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls