In message <[EMAIL PROTECTED]> on Sat, 6 Mar 2004 01:40:14 -0700, Joseph Bruni <[EMAIL PROTECTED]> said:
brunij> I'm working on a server that will handle connections from brunij> clients on two different interfaces -- a public interface and brunij> a private. What I would like to do is somehow encode into a brunij> certificate which interface the client is allowed to connect brunij> on. (I realize that there is no technical reason for a client brunij> preferring one interface over the other, but this is for a brunij> business/political reason. Clients allowed to connect via the brunij> private interface must be excluded from the public interface brunij> and vis versa.) There are two ways to do that that doesn't require some kind of custom certificate extension: 1. produce "public" and "private" certificates from two different CAs. Today, that's going to work with all software that uses SSL, since that's supported by the protocol. 2. have two different policies (and therefore policy OIDs) for "private" and "public" certificates. Unfortunately, because the world hasn't yet grasped how to handle multiple policy PKIs, very much fewer applications know how to select certificates based on policies. For more information, I'd like to recommend a book on PKI that covers policies[1] and RFC3280, sections 4.2.1.5, 4.2.1.6, 4.2.1.12, 4.2.1.15 and section 6. ------ [1] I like this book: http://www.amazon.co.uk/exec/obidos/ASIN/0471397024/qid=1078566992/sr=1-4/ref=sr_1_11_4/026-9448816-7804442 but there is a large selection to choose from: http://www.amazon.co.uk/exec/obidos/search-handle-form/026-9448816-7804442 ----- Please consider sponsoring my work on free software. See http://www.free.lp.se/sponsoring.html for details. -- Richard Levitte \ Tunnlandsv�gen 52 \ [EMAIL PROTECTED] [EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-708-26 53 44 \ SWEDEN \ Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED] Member of the OpenSSL development team: http://www.openssl.org/ Unsolicited commercial email is subject to an archival fee of $400. See <http://www.stacken.kth.se/~levitte/mail/> for more info. ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
