Re: Clarification of my remarks about Netscape

[Hal <hfinney@shell.portal.com>]

-----BEGIN PGP SIGNED MESSAGE-----

"Amanda Walker" <amanda@intercon.com> writes, quoting someone from
Netscape:

>> I didn't bother imbedding the RSA Unaffiliated User CA because I 
>> didn't think server operators would use it to get certificates. 

>Well, it's what Apple is using for PowerTalk signers (which are a key pair and 
>X.509 certificates, by default from the Unaffiliated User PCA).  It makes 
>sense for personal (as opposed to organizational) servers, such as someone 
>running MacHTTP for their home page...

>On the other hand, if RSA has set up a server PCA, that should be suffcient 
>for now.  I wonder what the certification policy is, though--how do you prove 
>that you control a given server?  For an Unaffiliated User CA certificate, you 
>just have to show a notarized application and two forms of ID, one with a 
>photo (driver's license, passport, etc.).  I can't off hand think of an 
>equivalently strong way to ID control of a server...

This relates to the other part of my question, which didn't get answered:
what is the relationship between the name found in the X.509 certificate
and the server?  Does X.509 include an internet address like mcom.com,
and the Netscape client checks that this matches the address of the
server it is connecting to?  I am not very familiar with the certificate
format but I had the impression that it used a very different naming
scheme.

Or does the client accept any valid certificate without regard to the
connection if any between the name in the certificate and the server to
which it is connected?  This whole area was left undefined in the SSL
spec but will be important for interoperability.

Hal

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQBVAwUBLu5AkhnMLJtOy9MBAQEFQgH/dmiiEjycULNdDCNiU8SkoB57bHv9W5Lc
d+K7cBqq0ZknCwXtqZtbPTR7d8F1z0WFbMlP6QF3zywVz2GrDIg5kg==
=qQ9u
-----END PGP SIGNATURE-----