Re: A plan for PKIX, LDAPv3, and ;binary

["Kurt D. Zeilenga" <Kurt@OpenLDAP.org>]

I guess I wasn't clear enough in what I said.  I meant:

  a) Some clients which request (using LDAPv3) "userCertificate"
     expect "userCertificate" to be returned.
  b) Some clients which request (using LDAPv3) "userCertificate"
     expect "userCertificate;binary" to be returned.

But I'll revise my conclusion a bit...

This makes it hard for a server to support both.  The
plan gives the choice of whether to support neither,
one or the other, or both to the implementor.  I list
both here because the implementor could return the
attribute twice (once as "userCertificate", once as
"userCertificate;binary").

Basically, the specification needs to detail the definitive
mechanism for requesting and transferring certificates in
LDAP.  Beyond that, we need to very careful not to disallow
implementations from being "liberal" with "non-strict" peers.

Kurt