Samu: >>> - Has this draft been vetted through pkix? I am curious: what >>> happens if both the CN and SAN are present? Which one takes >>> precedence? In your Appendix B, you show the CN and SAN as both >>> being the same, but what happens if they are different? You may >>> want to check with the pkix WG folks to make sure that the your >>> use of identities in CN and SAN are okay. > > CN and SAN should not be different. The SAN is the primary way of > incorporating the HITs into the certificates. The CN part is a reminder for > the developer that the DN cannot be empty and as a last resort you can put > the HIT into the CN. IMO it should be clearly written into the document that > when CN is used it must be the same HIT as the SAN.
Actually, RFC 5280 does allow an empty subject name if the SubjectAltName extension is critical. Was the PKIX WG asked to review this document? Russ _______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
