[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: Can ID be different than SubjectAltName field of theCertificate
>If the Policy on my server my server (responder in this case) is key-ed by
the
>other party ID and I allow ID payload and cert mismatch as you suggested -
than
>person A could impersonate his boss by sending boss's ID and person's A
valid cert.
>In this case my policy will select wrong entry in SPD.
I would suggest extracting the SubjectAltName from the certificate
and using that to key into your Policy database. If certs are being
exchanged there's not much need for the ID payload since the cert
provides an unforgable identity by definition.
Of course if certs aren't being exchanged via IKE then one way to
identify which cert to retrieve via alternate means would be by the
contents of the ID payload.
-dave
Follow-Ups: