=?ISO-8859-1?Q?Michael_Str=F6der?= wrote: > > Paul Hoffman wrote: > > At 4:42 PM +0200 6/19/10, Michael Ströder wrote: > >> Alexey Melnikov wrote: > >>> Paul Hoffman wrote: > >>>> No, I'm saying that the order in which you are supposed to take the > >>>> DCs has historically been unclear. "Most significant" means different > >>>> things to different people. > >>>> > >>> I probably sound like a broken record, but the order is very clear for > >>> LDAP. I don't see why is this going to be different for X.509 > >>> certificates. > >> > >> Yes, I concur RFC 2247 is pretty clear and is meant to be applied to X.500 > >> names as well. > > > > ...and you think that all (or even typical) PKIX implementers read either > > of those documents? > > Some of them do. > > If you dig in mailing list archives you will find that I know enough about > deficiencies of real-world software. And I tracked down quite a few bugs in > software of "major" PKI vendors some of them related to DN (string) handling. > > But what does that tell us? To give up writing or referencing RFCs?
Since the document under discussion is supposed to become a "Best current practice" document, I'm really wondering which of the existing implementations actually implement server endpoint matching based on DC components of a certificate subject name? I would assume that matching to more than one CN= might be more common than DC matching. -Martin _______________________________________________ certid mailing list [email protected] https://www.ietf.org/mailman/listinfo/certid
