Re: distinguished name order

Michael Richardson <mcr+ietf-SWp7JaYWvAQV+D8aMU/[email protected]> Wed, 30 Jul 2025 14:07:07 -0400

Newsgroups	gmane.comp.encryption.openssl.user
Message-ID	<[email protected]>

Mike <debian-jy+RX4/[email protected]> wrote:
    > Thanks, that clears it up.

    > Viktor Dukhovni wrote:
    >> And now the mythical dirName name constraints

    > Yeah, is there anywhere that it's described what's actually supported
    > in the wild?  I'm finding that Golang's crypto/x509 library comes up
    > short in recognizing certain critical-marked extensions.  (IDK which
    > ones yet.  Using trail and error to find out.)

This would make a good OpenSSL conference talk.
Maybe even a LAMPS BCP.
Maybe even advise to mark some extensions as never-usefully-deployed.
Or not useful for the Internet, or outside of a very controlled ecosystem.

I think US federal agencies use all sorts of things that just aren't
implemented outside of the RFPs that supply them.  Maybe this also applies
across many governments.  Maybe there is an interesting common subset of
extnesions that would help everyone, if only we could depend upon them.

Name Constraints definitely falls into this category to me.

--
Michael Richardson <mcr+IETF-SWp7JaYWvAQV+D8aMU/[email protected]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

-- 
You received this message because you are subscribed to the Google Groups "openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/21700.1753898827%40obiwan.sandelman.ca.

signature.asc (application/pgp-signature, 515 B)