RE: Re: Certificate Validation and Subject Analysis

Sorry, after reading this again I don't think I was very clear.  The IESG folks believe that the certificate validation requirements are inherited through our dependency on TLS.  TLS includes a reference to the PKIX certificate specs.  They don't see the requirement as an EPP requirement, but a TLS requirement.

-Scott-

 -----Original Message-----
From: 	Hollenbeck, Scott [mailto:[email protected]]
Sent:	Thursday, December 07, 2006 11:25 AM Eastern Standard Time
To:	Frank Thompson; Francisco Obispo
Cc:	Alexander Mayrhofer; [email protected]
Subject:	RE: [ietf-provreg] Re: Certificate Validation and Subject Analysis

> -----Original Message-----
> From: Frank Thompson [mailto:[email protected]] 
> Sent: Thursday, December 07, 2006 10:37 AM
> To: Francisco Obispo
> Cc: Alexander Mayrhofer; [email protected]; Hollenbeck, Scott
> Subject: Re: [ietf-provreg] Re: Certificate Validation and 
> Subject Analysis
> 
> 
> Hello,
> 
> Afilias does not employ CN idenity ACL checking either for the same 
> reasons as NIC.VE, but use other hardware/software solutions 
> for client 
> idenity and IP ACL validation.
> 
> Therefore we also believe that this does not belong in the 
> EPP protocol.

Well, you guys will need to take that up with the IESG after reviewing
RFC 3280.  In the mean time, what do you do if the certificate presented
from a client has valid certification path signatures, but the names
have nothing to do with that client?

-Scott-