About RFC4985, SRVName
Erwann Abalea <[email protected]>
| Newsgroups | gmane.ietf.x509 |
|---|---|
| Message-ID | <CA+i=0E4_mP3gtEZLg6adgdaHhWdV-_Tgy_OLNWxOG_fbK-xw1g@mail.gmail.com> |
Bonjour, I think it's the right list for this topic. There is an attempt to allow SRVNames in public X.509 certificates as defined by CABForum. This would follow RFC4985. However, the NameConstraints matching rules as written in section 4 doesn't allow for an empty SRVName restriction; the SRVName has a SIZE(1..MAX) constraint, and the text doesn't deal with both service name and DNS name missing. Having this "fully permitted" constraint may seem stupid, but it's the only way to completely forbid SRVNames, by using such constraint in the excludedSubtrees portion of the NC extension. What is the proper way to solve this issue? Suppress the size constraint on the SRVName element in section 2? Modify section 4 to allow the single '.' character (U+002E) to represent both service and DNS names missing? -- Erwann. _______________________________________________ pkix mailing list [email protected] https://www.ietf.org/mailman/listinfo/pkix