On Tue, Sep 22, 2009 at 09:28:22AM +0200, Robert Kisteleki wrote: > Jeff, tell us, can your users in MIT choose another CA for client > authentication inside MIT? Can they choose the same DN with all of > them (as you stated above, it "works just fine")?
Yes, and we have at least one department that runs their own CA, so
this in fact happens.... and it isn’t a problem for us.
It doesn’t even matter if someone uses the same DN in a different CA
because we only trust a CA if it issues a DN to the correct person. So
it doesn’t matter to use if a departmental CA uses the same DN for a
person as we do... as long as it is the same person!
However, to be honest, our central IT services require a certificate
issued by us. Not because of technical issues but because of trust
issues. I can tell some interesting stories related to this, however
it would be a bit off-topic for this group.
-Jeff
--
========================================================================
Jeffrey I. Schiller
MIT Network Manager
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue Room W92-190
Cambridge, MA 02139-4307
617.253.0161 - Voice
[email protected]
========================================================================
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ sidr mailing list [email protected] https://www.ietf.org/mailman/listinfo/sidr
