[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Can ID be different than SubjectAltName field oftheCertificate
Tamir,
>We agree that there should be strong bond between the information on the
>certificate
>and the
>ID payload, even so, this does not mandate that they be identical. The way
>in which you
>bind the ID payload to the appropriate
>SPD entry should be a local policy matter. For example, your local policy
>could bind
>foo.bar.com to a certain ip address or
>you could use Secure DNS to do the binding.
I agree with your observations, but I think it fair to say that the best
case arises when the ID in the cert matches the SPD entry. Any other
situation creates dependencies on other databases, which creates more
opportunities for management-induced vulerabilities, etc.
Steve
References: