Subject: [AAA-WG]: [issue] Clarification in certificate naming schema

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 20 Aug 2001 16:35:04 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-20
Reference: 
Document: CMS-02
Comment type: Technical
Priority: S
Section: 
Rationale/Explanation of issue:

The naming schema of AAA servers certificates are spread among
different chapters in the specification.

In 1.5 it's said that "The realm of the participants is found in the
subjectAltName field of the Diameter server's X.509 certificate".

In 3.1, between the checks done by the DSA initiator when the DSAA is
received, it's said that:

    - the realm part of the user's NAI must occur as a subjectAltName
      (with the dNSName option) in the AAA server's certificate. This
      dNSName MUST be of the form "Diameter-<XXX>.<domain>" where
      <domain> is the FQDN's domain component and <XXX> can be
      anything (e.g. "Diameter-1.baltimore.com", "Diameter-
      west.sun.com") chosen by the Diameter server administrator.

Finally, a whole chapter (3.2. Certificate Requirements) deals with
the same topic. Specifically,  it's said that:

    Certificates [...] MUST also include a Diameter node's FQDN, which
    is typically added in the Host-Name AVP [1], as one of the values
of
    the subjectAltName extension of the Certificate.

And

   For Diameter nodes (capable of acting as recipients for
   confidentiality), the FQDN MUST be of the form "Diameter-
   <xxx>.<realm>". 

And last but not least

   1. Where a Diameter node is verifying a signature it needs to be
    able to compare the identity of the signer against the identity
    in the Host-Name AVP.

Requested change:

The main purpose would be to clarify the whole topic. I'd suggest:

- Unifying the terminology. Using "realm" always or "domain" always.
- To switch the long explanation of chapter 3.1 to a more appropriate
place (chapter 3.2), including a reference to it in the item of 3.1
chapter.
- Explaining which AVP is Host-Name AVP

Additionally I'd like to receive a clarification about the realms
involved. I suppose that the "realm part of the user's NAI" is carried
by means of the Destination-Realm in the DSAR, but I'm not sure. BTW

Regards

  // M.A.