X.509 certificate schema (Re: Syntax open issues)

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

I believe that further standardization of X.509 certificate
schema for LDAPv3 is quite important.  In particular, the
X.509 certificate schema needs to get fixed.

The "core" specification also needs to consistently reference
X.500. It needs to reference a single edition, the 2nd.

We should avoid recycling the "core" specification at Proposed
if at all possible.  Fixing the certificate schema or including
material allowing references to multiple X.500 editions will
likely cause recycling.

For these reasons, I suggested removing the broken certificate
schema from the "core" specification and working with PKIX
WG to include fixed certificate schema in their LDAPv3 schema
document.  I have contacted the PKIX'ers and find they are
willing and able to do the necessary schema work as part
of their existing work.

As far as the problem you raise, this can be somewhat
mitigated by stating in the Changes section something like:

  - Certificate schema removed.  Updated certificate
    schema is specified in [insert reference].

Kurt