Re: LDAP Certificate transfer syntax (draft-ietf-pkix-ldap-v3-05.txt)

[Harald Koch <chk@pobox.com>]

Of all the gin joints in all the towns in all the world, Ken Stillson
had to walk into mine and say:
> 
>   "A PKI object should be placed into a LDAP directory such that the LDAP
>    object DN matches the subject DN of the object."

It's supposed to be the other way around, isn't it? One should issue
certificates with a subject DN that matches the LDAP object DN.

Anyway, there are many environments where a certificate issued by one
organisation must be stored in a directory belonging to another. I don't
believe that an arbitrary restriction like this won't fly.

-- 
Harald Koch     <chk@pobox.com>