[Smcwg-public] Technically Constrained S/MIME SubCas
Dimitris Zacharopoulos (HARICA)
dzacharo at harica.gr
Mon Nov 15 13:13:09 UTC 2021
On 12/11/2021 6:03 μ.μ., Stephen Davidson wrote:
> Thank you Dimitris.
> The current draft language for the S/MIME BR is at
Reading the challenges described in past discussions, are we sure we
want to add a requirement for directoryName constraints in
S/MIME-capable Technically constrained subCA Certificates? Would it be
easy for such a subCA to issue an end-entity certificate that includes
the subject: "C=US,CN=John Doe,Email=john.doe at example.com"?
Perhaps we should avoid setting requirements for directoryName
constraints at the first version of the SMBRs.
I'm also having trouble following the connection with section 126.96.36.199 in
the following text:
"For each |directoryName| in |permittedSubtrees|, the CA MUST confirm
the Applicant's and/or Subsidiary's Organizational name and location
such that end entity certificates issued from the subordinate CA
Certificate will be in compliance with Section 188.8.131.52
Perhaps 184.108.40.206 is more close to what you were looking for?
> Regards, Stephen
> *From:* Smcwg-public <smcwg-public-bounces at cabforum.org> *On Behalf Of
> *Dimitris Zacharopoulos (HARICA) via Smcwg-public
> *Sent:* Wednesday, November 10, 2021 12:25 PM
> *To:* smcwg-public at cabforum.org
> *Subject:* [Smcwg-public] Technically Constrained S/MIME SubCas
> Following-up on today's meeting, here are some links of discussion
> threads regarding the technical constraints for S/MIME-capable subCAs:
> * (discussion in 2017)
> * (most recent one)
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Smcwg-public