Kevin P. Fleming wrote:
Marco Colombo wrote:
What field is that, exaclty? v3 extension?
I'm not sure... it's in the OpenSSL headers files as
"NID_pkcs9_emailAddress".
Oh, I know nothing of OpenSSL API. It seems too me (but I'm not sure)
it's the emailAddress attribute in the DN. Some time ago I did some
research, and found this:
RFC 2459
4.1.2.6 Subject
[...]
In addition, legacy implementations exist where an RFC 822 name is
embedded in the subject distinguished name as an EmailAddress
attribute. The attribute value for EmailAddress is of type IA5String
to permit inclusion of the character '@', which is not part of the
PrintableString character set. EmailAddress attribute values are not
case sensitive (e.g., "[EMAIL PROTECTED]" is the same as
"[EMAIL PROTECTED]").
Conforming implementations generating new certificates with
electronic mail addresses MUST use the rfc822Name in the subject
alternative name field (see sec. 4.2.1.7) to describe such
identities. Simultaneous inclusion of the EmailAddress attribute in
the subject distinguished name to support legacy implementations is
deprecated but permitted.
So it seems its usage is deprecated. If you are to code a patch, you
may look into the alternative name(s). Those are standard v3 extensions.
As I understand it, comforming applications should look there in order
to find email addresses (of type rfc822Name). Of course, since you're
using your own CA, you could use whatever field/attribute, but keeping
an eye on standards won't hurt, IMHO. And after all your own mail was
an RFC. :-)
.TM.
--
____/ ____/ /
/ / / Marco Colombo
___/ ___ / / Technical Manager
/ / / ESI s.r.l.
_____/ _____/ _/ [EMAIL PROTECTED]
---
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html
