Salz, Rich wrote: > >> The certificate should have its own DN, use that. > > She's saying that it *doesn't.* > > SubjectDN is not unique. IssuerDN/Serial is unique, but this extension use > that.
SubjectDN of a *Certificate Authority* **MUST** be unique. There is some wording in PKIX and X.509 which creates the impression that a CA could be re-using the same Subject DName with different keys, but such an interpretation is a formally provable defect of the PKIX specification. Creating a certificate chain *MUST* be possible on the issuer name-> subject name chaining alone. Support for chaining by subjectKeyId is truely *OPTIONAL* based on the requirements in the specification, so reuse of the same DName with a different key would break certificate chaining (and verification) that is performed on the issuer->subject chain alone and is therefore prohibited. Support for the SubjectKeyIdentifier and AuthorityKeyIdentifier X.509v3 extensions is explicitly just *RECOMMENDED* and can therefore be absent from a perfectly PKIX-conforming minimum requirements RP. PKIX-conforming CA MUST NOT break minimum-requirements RPs, e.g. by creating/issuing CA certificates with identical subject names but different public keys. -Martin _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
