Subject: RE: which usercertificate attribute

From: Aram Perez <[email-masked]>
Date: Mon, 10 Apr 2000 09:53:59 -0400

David is right. Why have standards if you can't interoperate with other
implementations? Over a year ago I asked if there was a standard way of
getting a user's certificate from an LDAP directory. While I received a
number of replys, not one reply said: There is a standard LDAP schema which
you can use.

Regards,
Aram Perez

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Monday, April 10, 2000 8:46 AM
To: [email-masked]
Subject: Re: which usercertificate attribute

Peter,

Bob put the right words in my mouth :-).  IETF specifications use
"MUST", "SHOULD", and "MAY" in a uniform manner to enhance the
ability to interoperate.  MUST always means "must implement",
not "must use".

But I meant mandatory in an even more limited sense:  *if* applications
are going to support LDAP (i.e. X.500 directory attributes) to retrieve
certs, then they MUST be able to do it in accordance with the 
standard LDAP schema.

Dave

> To: [email-masked]
> Subject: Re: which usercertificate attribute
> 
> "David P. Kemp" <[email-masked]> writes:
> 
> >The new section 4 could mention certdist as an option, but standard LDAP 
> >should be mandatory.  
> 
> Why should it be mandatory?  I can see that saying that finding a cert is
> a good idea, but mandating it is not (there will always be situations
where
> it doesn't make sense), and mandating one particular way of doing it is
even
> worse - even if you are in a situation where retrieving a cert is useful,
> being forced to do it via LDAP is an unnecessary restriction.
> 
> Peter.

---

From: "Walter Williams" <[email-masked]>
Date: Mon, 10 Apr 2000 10:49:49 -0400

Actually, smimeUserCertificate and userCertificate objects are both part of
the IETF standard organizationalPerson and inetOrgPerson schemas.  The first
is RFC2256 if my memory does not fail me and the second is a draft on the
standards track, and has been widely adopted in the industry.  Therefor:
There is a standard LDAP schema which you can use

Walter Williams
TSD
Senior IT Analyst
Genuity

Please note: GTE Internetworking is now Genuity

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Aram Perez
Sent: Monday, April 10, 2000 9:54 AM
To: [email-masked]
Subject: RE: which usercertificate attribute

Regards,
Aram Perez

-----Original Message-----
From: David P. Kemp [mailto:[email-masked]]
Sent: Monday, April 10, 2000 8:46 AM
To: [email-masked]
Subject: Re: which usercertificate attribute

Peter,

Dave

where
even