Jeffrey I. Schiller wrote:
Exactly how is this bad? Sure for S/MIME encryption you need to know which certificate to encrypt a message for (though you could do it for all of them if the number was reasonable). However for authentication you can have many certificates with the same DN. It works just fine. I should know, I run the PKI for MIT and on the client side people have one certificate per computer in general (because getting one on each computer is easier then having them figure out how to export the certificate as a pkcs12 object and import it to the other browser). Yes, we use X.509 certificates for client authentication.
Jeff, tell us, can your users in MIT choose another CA for client authentication inside MIT? Can they choose the same DN with all of them (as you stated above, it "works just fine")?
Robert _______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
