Re: Last Call: Discovering LDAP Services with DNS to Proposed Standard

[Lawrence Greenfield <leg+@andrew.cmu.edu>]

On further thought, I'm actually fairly unhappy about this approach to
constructing the name of the certificate needed.

There are other uses of SRV records; let's say I have the IMAP
protocol running, so I look up

_imap._tcp.example.net.  IN  SRV 0 0 143 imap.example.net.

If I then execute STARTTLS on this service, should I be expecting a
certificate for "example.net"?

Now all of the services for example.net share the same certificate,
even though administratively IMAP and LDAP might be in two seperate
groups/organizations/whatever and should have no business being able
to spoof each other.  Delegating one service to a subgroup shouldn't
compromise every other service for a domain.

Larry