Subject: [Ipsec] ID and subject/subject-alt in certificate, match or not to match?

From: Kevin Li <[email-masked]>
Date: Thu, 07 Apr 2005 12:20:42 -0700

Hi,

IKEv2 doesn't require ID in ID payload to match that subject/subject-alt 
in certificate.

This flexiblity is great in switch/router/multi-home-host environment 
where there may be many interfaces/ip-addresses. In that case, we may 
choose using a global certificate of switch/router, don't need to create 
individual certificate for each interface/ipaddress/fqdn.

IKEv2-17 ===============================================
3.5 Identification Payloads

  The Identification Payloads, denoted IDi and IDr in this memo, allow
  peers to assert an identity to one another. This identity may be used
  for policy lookup, but does not necessarily have to match anything in
  the CERT payload; both fields may be used by an implementation to
  perform access control decisions.
=======================================================

I don't see IKEv1 have such requirement (match) either from protocol 
perspective. But certain implementation (say racoon)  may insist such a 
match.

Does it mean that:
In reality, we have to ensure our id payload matched with subject/alt in 
certificate in order to interop?
What's the general concensus on this (match or not to match)?
I think this should be configurable instead of hardcoding the match if 
people really want it.

Thanks.

Kevin

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 8 Apr 2005 10:35:28 +0300

> perspective. But certain implementation (say racoon)  may insist such a 

Yes. That is true, for some reason lots of people required them to
match exactly, and didn't allow configuring any function or lookup
table between them.

> certificate in order to interop?

In the RFC2401bis we now have PAD that will provide mapping from IKE
ID to the authentication data, including instructions how to find the
certificate. That PAD entry can also say that ID MUST match the
certificate, or it can say there can be some more complicated matching
done i.e. lookup from table to convert ID to name to search from
certificate, or subtree match etc...

> I think this should be configurable instead of hardcoding the match if 

It should be configurable, and one of the options MUST be to do exact
match. Other options are left more or less open, i.e. implementations
can implement other means of doing matching, depending what they want
and need. 
-- 
[email-masked]