Subject: RE: Does Smime works fine with Windows 2000 PKI

From: Laurent Deffranne <[email-masked]>
Date: 11 May 2000 15:19:05 +0200

Walt,

Do you mean that there are difficulties to access through LDAP an Active Directory, as you want to read or use X509 certificates ?

By the way,does somebody know issues about Active Directory LDAP, or issues to read a certificate in an Active Directory ?

For me it would be a mistake to use now the "brand new" Active Directory, but if someone could tell me where I can find proofs of lack of compatibility (from Microsoft, there must be surely one of two), this would interrest me. 

Laurent

walter.williams%genuity.com@Internet
11/05/2000 14:54
To:	Laurent Deffranne/GKBCCB@GKBCCB, ietf-smime%imc.org@Internet
cc:	 

Subject:	RE: Does Smime works fine with Windows 2000 PKI

Laurent;

Yes, certs issued from a W2K CA can be used for S/MIME, and no less so than
certs issued from Baltimore, Iplanet or any other CA vendor or product.  The
main issue is not will they work, but will you be able to validate the
certs.  Unless the person issuing the cert from W2K has provided you with
their server's cert, or they have certified their CA with the signature of
the publicly known CAs you will not be able to easily verify the signature
to its source.  This is not the most technically acurate way of saying this
but I'm not awake yet.  Baltimore has preregistered there CA with the
vendors distributing products, as has Verisign, Thaught, and many others.
Just make certain that you have the certificates for the W2K CA, and access
to its revocation list so you can validate properly and you'll be fine.

Walt Williams
TSD-Systems
Senior IT Analyst
Genuity
www.genuity.com

Please note: GTE Internetworking is now Genuity.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Laurent Deffranne
> Sent: Thursday, May 11, 2000 5:45 AM
> To: ietf-smime
> Subject: Does Smime works fine with Windows 2000 PKI
>
>
> Hi everybody,
>
> Just a question :
>
> Is there any known issues using S/MIME with Win2000PKI-certificates ?
> More generally, are Win2000 certificates usable with (and
> understood by ) the others mailers (especially Lotus Notes,
> Netscape, Eudora +plug-in?)
>
> Isn't Baltimore Unicert a "better choice" due to its greater
> compatibility ?
>
> Any advices are welcome.
>
> Regards,
>
> Laurent Deffranne

---

From: "Walter Williams" <[email-masked]>
Date: Thu, 11 May 2000 09:26:44 -0400

Let me take the points one at a time and inline:

> From: Laurent Deffranne [mailto:[email-masked]]
> Sent: Thursday, May 11, 2000 9:19 AM
> To: walter.williams
> Cc: ietf-smime
> Do you mean that there are difficulties to access through LDAP an
> Active Directory, as you want to read or use X509 certificates ?
>

No.  However, are you going to open your active directory to anonymous LDAP
queries over the Internet?  If not, are you limiting S/MIME to internal use
only?  If not then you are somewhat back to square one.

> By the way,does somebody know issues about Active Directory LDAP,
> or issues to read a certificate in an Active Directory ?

This worked just fine for us here, but the problem we had with AD was that
it does not support inetOrgPerson, and thus can't easily be synched up with
most external LDAP directories.  You'll find you'll want a metadirectory
connector to synch it with any external directory.  Again, this is not an
issue if you're willing to directly expose AD to internet use.
>
> For me it would be a mistake to use now the "brand new" Active
> Directory, but if someone could tell me where I can find proofs
> of lack of compatibility (from Microsoft, there must be surely
> one of two), this would interrest me.
>
AD seems to work just fine, if you don't mind working with something with a
proprietary schema.  Any LDAP and S/MIME aware client we pointed at it
understood the contents just fine, so the schema does not seem to impact
client interoperability.

---

From: "Piers Chivers" <[email-masked]>
Date: Thu, 11 May 2000 18:16:59 +0100

MS have published a White Paper on Win2k PKI interoperability with other
leading PKI vendor products.  The WP is available on their MSDN website
(can't remember where but it's called win2kpkinterop.doc).

In my experience Win2k PKI is excellent as choice for an Enterprise PKI.  It
integrates well with AD (not surprisingly).  However, as a commercial PKI
the best thing that can be said about it is that it is free.  And that
probably sums it up succintly.

Piers

-----Original Message-----
From: Laurent Deffranne [mailto:[email-masked]]
Sent: 11 May 2000 14:19
To: walter.williams
Cc: ietf-smime
Subject: RE: Does Smime works fine with Windows 2000 PKI

Walt,

Do you mean that there are difficulties to access through LDAP an Active
Directory, as you want to read or use X509 certificates ?

By the way,does somebody know issues about Active Directory LDAP, or
issues to read a certificate in an Active Directory ?

For me it would be a mistake to use now the "brand new" Active
Directory, but if someone could tell me where I can find proofs of lack
of compatibility (from Microsoft, there must be surely one of two), this
would interrest me.

Laurent

Laurent;

Yes, certs issued from a W2K CA can be used for S/MIME, and no less so
than
certs issued from Baltimore, Iplanet or any other CA vendor or product.
The
main issue is not will they work, but will you be able to validate the
certs.  Unless the person issuing the cert from W2K has provided you
with
their server's cert, or they have certified their CA with the signature
of
the publicly known CAs you will not be able to easily verify the
signature
to its source.  This is not the most technically acurate way of saying
this
but I'm not awake yet.  Baltimore has preregistered there CA with the
vendors distributing products, as has Verisign, Thaught, and many
others.
Just make certain that you have the certificates for the W2K CA, and
access
to its revocation list so you can validate properly and you'll be fine.

Walt Williams
TSD-Systems
Senior IT Analyst
Genuity
www.genuity.com

---

From: "Walter Williams" <[email-masked]>
Date: Thu, 11 May 2000 14:26:29 -0400

Free only if you own Windows 2000, but yes that means free for most folks
eventually.  However, most of the costs associated with a PKI are not in the
actual technology, but rather in the legal side of things.  Outsourcing to a
CA vendor such as Baltimore, Entrust or Verisign allows you to offset the
soft costs to a company which has already done its legal home work for you.
There is a lot of discussion on the cost/benefits on inhousing a CA which
can be found in EMA sessions, often available on www.ema.org.  Also look at
www.pki.org for interoperability testing (not just white papers here).  EMA
has recently published the findings of a large test regarding PKI interop
which involved many vendors, the federal government and this is available
again at www.ema.org.  I don't know if the tests have included W2K in the
past but we can ask Microsoft to participate as they are an ongoing process.

Walt

> [mailto:[email-masked]]On Behalf Of Piers Chivers
> Sent: Thursday, May 11, 2000 1:17 PM
> To: 'Laurent Deffranne'; 'walter.williams'
> Cc: 'ietf-smime'