On 26 Jun 2011, at 11:39 AM, Leo Richard Comerford wrote: > What should I use to whitelist certificates by? Specifically, what can > I whitelist on to prevent false positives? For example, the obvious > thing seems to be Distinguished Name. But can I safely assume that any > two certificates issued by a big-name commercial CA to two different > entities will have different (full) DNs?
I would hope so--- but like you I have little confidence in the CAs being relied on to do the right thing. What about using the subjectPublicKeyInfo, or a hash of that? This has some pluses and minuses: 1. False positives shouldn't be a problem; if two users have the same subjectPublicKeyInfo they functionally have the same key. 2. You don't need to rely on the CA getting anything right. You'd not be using the PKI at all. 3. If a user switches to a new key, they can't just get a certificate for the new key and keep going--- they'll need to go through the process of putting their new key on your whitelist as well. (But you could fallback to relying on the CA for this.) ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
