Re: DER encoding in RFC 3161

Martin Rex <[email protected]> writes:

>the breakage occurs when suddenly expecting that malleable parts of an X.509
>certificate (=everyting *OUTSIDE* of ToBeSigned) are guaranteed to be
>unchanged by whatever storage and transports a Certificate is going through,
>including any ASN.1 length encodings on the outside.

Which is the case for everything I know of.  I assume you must have some
special-case situation you've run into where this is an issue, but since
"certificate fingerprints" are pretty much the universal unique identifier for
the things - fire up any cert viewer and you'll see them used, for example -
I'd say that if there is something out there that rewrites certs and breaks
the fingerprint then whatever it is is broken and needs to be fixed.

More to the point, we've been using cert fingerprints for thirty-odd years
without running into any problems, so if something turns up now that breaks
them then that's the problem, not cert fingerprints.

Peter.