- From: Mo McRoberts <mo.mcroberts@bbc.co.uk>
- Date: Tue, 3 Jan 2012 21:37:58 +0000
- To: Kingsley Idehen <kidehen@openlinksw.com>
- Cc: public-xg-webid@w3.org
On 3 Jan 2012, at 14:36, Kingsley Idehen wrote: >> CN=www.freesoft.org is not a CN containing a URL, for a start. A CN is effectively arbitrary, will often be used for matching (cf. clients comparing SSL server hostnames). > > And emailAddress is not an Address either right? An emailAddress is an email address. Sheesh. > What do you think www.freesoft.org is then? Broadly: a FQDN In a commonName RDN value: an arbitrary label, which in a client cert is used for nothing except advertising. In SSL servers, it's used as a match source against what the UA expects it to be (which by convention, for reasons which are now obvious, is the FQDN of the server or a wildcarded derivative). But, to date, it still is largely a comparator — the closest you get to triggered behaviour when a certificate is presented is querying a locally-configured directory service for an entity matching the DN. >> >> (You could add a URI as a DN attribute, though, if you know the signing entity will accept it — just pick or define an appropriate attribute OID). >> >> Whether *parts* of a DN should trigger special processing on the part of a receiver is a different matter. I can't recall what ITU recs have to say on the subject. I do know that a number of free personal certificate issuers mandate that the CN is a fixed string. > > We are using a standard representation of an info card and its semantics, to construct a protocol with its own set of semantics i.e., the WebID verification protocol. Nothing that I've stated breaks anything re. X.509 or PKI. Neither does it break WebID. Its only issue is novelty. Of course it doesn't break anything re: X.509 or PKI. And it is a neat trick in novelty stakes, just like my terminal emulator turning URIs which appear in its window into hyperlinks is a neat (if imperfect) trick. What sprang to mind was whether what -other people- are doing with those RDNs (i.e., anything they like) would break what you were doing when you processed them. And, if you're overloading semantics of DNs, you're as well just defining a new attribute… M. -- Mo McRoberts - Technical Lead - The Space, 0141 422 6036 (Internal: 01-26036) - PGP key CEBCF03E, Project Office: Room 7083, BBC Television Centre, London W12 7RJ
Received on Tuesday, 3 January 2012 21:40:54 UTC