On 5/16/25 9:57 PM, Viktor Dukhovni via mailop wrote:
You probably should not trust the subject name of a client certificate from a public CA to be a valid binding to local authorisation data. In typical deployments that means you trust every CA/B forum public CA to identify your authorised users, which would not be a good idea.
I assume that you're referring to the possibility that any trusted root CA could sign for a given subject.
I now realize that I failed to clarify that there are actually three aspects to consider: 1) authentication -- does the certificate validate, 2) is the certificate issued by a specific CA, and 3) is the subject authorized.
The 2nd part of that prevents the use of certificates for a given subject that other CAs might sign.
-- Grant. . . . _______________________________________________ mailop mailing list mailop@mailop.org https://list.mailop.org/listinfo/mailop
