[cabfpub] Ballot for limited exemption to RFC 5280 for CTimplementation
Rob Stradling
rob.stradling at comodo.com
Thu Sep 18 09:52:59 UTC 2014
On 18/09/14 03:01, kirk_hall at trendmicro.com wrote:
<snip>
> Proposed amendments to Baseline Requirements.
>
> New language is shown in */_bold , italics, and underlined._/*
>
> 1. Amend the Definitions as follows:
>
> Valid Certificate:**A Certificate that passes the validation procedure
> specified in RFC 5280 */_(except for the limited exemption provided in
> Appendix B)._/*
Kirk, this proposed change to the "Valid Certificate" definition makes
no sense to me at all.
I interpret "validation procedure specified in RFC 5280" to mean RFC5280
Section 6 (entitled "Certification Path Validation"), which has
absolutely nothing to say about duplicate serial numbers.
(The prohibition on duplicate serial numbers is in RFC5280 Section 4.1.2.2).
I think the "Valid Certificate" definition is intended to include all
certs that browsers accept, regardless of whether or not they've been
issued in full compliance with the BRs. (That's arguably an unfortunate
use of the word "Valid", but nonetheless I think this is the intent).
> 2. Amend Appendix B as follows:
>
> Appendix B – Certificate Extensions (Normative/)_;*Limited Exemption
> from Compliance with RFC 5280*_/**
Again, this makes no sense. The serial number field is not a
certificate extension.
IMHO, the BRs, as written, don't actually incorporate the RFC5280
Section 4.1.2.2 rule prohibiting duplicate serial numbers.
We could fix this by changing the title of Appendix B to "Certificate
Fields and Extensions", but until we do that, your proposed limited
exemption is a no-op.
<snip>
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
More information about the Public
mailing list