On Mon, Sep 21, 2009 at 06:49:26PM -0400, Christopher Morrow wrote: > sure, and as it happens you can also have more than one certificate > for mozilla.com .... which is 'bad'.
Exactly how is this bad? Sure for S/MIME encryption you need to know
which certificate to encrypt a message for (though you could do it for
all of them if the number was reasonable). However for authentication
you can have many certificates with the same DN. It works just fine. I
should know, I run the PKI for MIT and on the client side people have
one certificate per computer in general (because getting one on each
computer is easier then having them figure out how to export the
certificate as a pkcs12 object and import it to the other
browser). Yes, we use X.509 certificates for client authentication.
> I'm not sure that's the case, since I can go to startssl.com and get a
> cert for free that's good for 1yr and doesn't raise exceptions in +98%
> of the user base... or I can go to verisign get the same thing for
> 1k$. I'm also not sure that the web-ca world tracks at all well with
> the routing-ca world.
Your statement proves my point about competition. If it weren’t for
competition you would not have the option of getting one for free, or
even cheap!
> Is some of the concern here legacy space being pulled under 'RSA' by
> hook/crook? Could that be 'fixed' by IANA issuing certs to legacy
> address holders as that's likely the closest thing to the NIC that
> exists today and doesn't REALLY have the ability to enforce RSA-like
> restrictions as an RIR would?
Or we can just have a pseudo-RIR for the legacy space (pseudo because
it doesn’t allocate any new space, just keeps track of the old).
-Jeff
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
