RFC 4985
Internet X.509 Public Key Infrastructure Subject Alternative Name for Expression of Service Name
Internet X.509 Public Key Infrastructure: Subject Alternative Name for Expression of Service Name 🎀
okay bestie, here's the title block tea 🫶
- RFC number: 4985
- Working group: Network Working Group
- Author: S. Santesson, Microsoft
- Category: Standards Track
- Date: August 2007
- Obsoletes/Updates: the header doesn't list anything this one obsoletes or updates 🧚
Status of This Memo ✨
this one is an Internet standards track protocol for the Internet community, so it's asking for discussion and suggestions to make it better 💖 For where the protocol actually stands, check the current edition of "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Abstract 🦋
this doc defines a new name form that goes in the otherName field of an X.509 Subject Alternative Name extension. It lets a certificate subject be tied to a service name and a domain name, which are the two parts of a DNS Service Resource Record. literally the whole point 🔥
Table of Contents 🌸
1. Introduction ....................................................2
1.1. Terminology ................................................2
2. Name Definitions ................................................2
3. Internationalized Domain Names ..................................4
4. Name Constraints Matching Rules .................................5
5. Security Considerations .........................................6
6. Normative References ............................................6
Appendix A. ASN.1 Syntax ...........................................7
Appendix A.1. 1988 ASN.1 Module .................................7
Appendix A.2. 1993 ASN.1 Module .................................81. Introduction 💅
okay so this doc specifies a name form for X.509 certificates. A relying party can use it to check that a particular host is actually allowed to provide a specific service within a domain. main character energy 👑
RFC 2782 [N3] is the one that defines the DNS RR (Resource Record) for service locations, the SRV RR. It lets clients ask for a specific service/protocol in a specific domain and get back the names of whatever servers are available 🧚
existing name forms in X.509 certificates already support authenticating a host name, and that's useful when the client already knows the host's name before authentication happens 🦋
when a server host name gets discovered through a DNS RR lookup based on a service name, the client may need to authenticate that the server is authorized to provide the requested service, not just that its host name is right 💜
DNS servers might be capable of providing trusted information, but there are lots of other situations where the binding between a host's name and the service it provides needs extra credentials 🔐
ngl, the current dNSName GeneralName Subject Alternative name form only lets DNS host names be written in the "preferred name syntax" from RFC 1034 [N4]. So it isn't broad enough to express a service tied to that domain 🙈
1.1. Terminology 🎀
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [N1] 🫶
2. Name Definitions 🌸
this section defines the SRVName name as a form of otherName from the GeneralName structure in SubjectAltName, which is defined in RFC 3280 [N2] ✨
id-on-dnsSRV OBJECT IDENTIFIER ::= { id-on 7 }
SRVName ::= IA5String (SIZE (1..MAX))the SRVName, if it's present, MUST contain a service name and a domain name in this form:
_Service.Namethe content of the components of this name form MUST be consistent with the matching definitions of those components in an SRV RR, per RFC 2782 [N3] 💖
here's what the components look like:
- Service: the symbolic name of the desired service, as defined in Assigned Numbers [N5] or locally. An underscore (_) gets prepended to the service identifier so it doesn't collide with DNS labels that show up in the wild. Some widely used services, notably POP, don't have a single universal name. If Assigned Numbers names the service, that name is the only one allowed in the service component of this name form. The Service is case insensitive 🦋
- Name: the DNS domain name of the domain where the specified service is located. If the domain name is an Internationalized Domain Name (IDN), then encoding it in ASCII form SHALL be done as defined in section 3 🌈
okay this part is lowkey important: even though this name form is based on the SRV RR definition in RFC 2782 [N3] and can help strengthen authentication for DNS-based service discovery, this standard doesn't define any new conditions or requirements for using SRV RRs to discover services, or for when that's appropriate 🧚
the format of a DNS RR, per RFC 2782, also includes a protocol component (_Service._Proto.Name). That protocol component is NOT included in the SRVName in this document. The purpose of the SRVName is limited to authorizing service provision within a domain. It's outside the scope of the SRVName to verify that the host is using any intended protocol. Leaving the protocol component out gets us two big wins 🔥
- one certificate with a single SRVName can be issued to a host that offers multiple protocol alternatives
- name constraints processing rules (specified in section 4)are significantly less complex to define without the protocol component
a present SRVName in a certificate MUST NOT be used to identify a host unless one of the following conditions applies:
- use of this name form is specified by the security protocol being used and the identified service has a defined service name according to RFC 2782, or;
- use of this name form is configured by local policy 💅
3. Internationalized Domain Names 💜
IA5String is limited to ASCII characters, so to fit internationalized domain names into this structure, conforming implementations MUST convert IDNs to the ASCII Compatible Encoding (ACE) format from section 4 of RFC 3490 [N6] before storing them in the Name part of SRVName. Specifically, conforming implementations MUST perform the conversion from section 4 of RFC 3490 [N6], with these clarifications 🫶
- in step 1, the domain name SHALL be considered a "stored string". That is, the AllowUnassigned flag SHALL NOT be set;
- in step 3, set the flag called "UseSTD3ASCIIRules";
- in step 4, process each label with the "ToASCII" operation; and
- in step 5, change all label separators to U+002E (full stop)
when comparing DNS names for equality, conforming implementations MUST perform a case-insensitive exact match on the entire domain name. When evaluating name constraints, conforming implementations MUST perform a case-insensitive exact match on a label-by-label basis 🔐
implementations SHOULD convert IDNs to Unicode before display. Specifically, conforming implementations SHOULD perform the conversion from section 4 of RFC 3490 [N6], with these clarifications:
- in step 1, the domain name SHALL be considered a "stored string". That is, the AllowUnassigned flag SHALL NOT be set;
- in step 3, set the flag called "UseSTD3ASCIIRules";
- in step 4, process each label with the "ToUnicode" operation; and
- skip step 5
Note: implementations MUST allow for increased space requirements for IDNs. An IDN ACE label begins with the four extra characters "xn--" and may need as many as five ASCII characters to represent a single international character. Plan for the extra room 🙈
4. Name Constraints Matching Rules 🔥
name constraining, as specified in RFC 3280, MAY be applied to the SRVName by adding a name restriction in the name constraints extension, in the form of an SRVName 💖
SRVName restrictions can be written as a complete SRVName (_mail.example.com), as just a service name (_mail), or as just a DNS name (example.com). The service name part and the DNS name part of the SRVName restriction are handled separately 🧚
if the restriction includes a service name, then that restriction can only be satisfied by an SRVName that includes a matching service name. If the restriction has an absent service name, then it's satisfied by any SRVName that matches the domain part of the restriction ✨
DNS name restrictions are written as host.example.com. Any DNS name you can build by adding subdomains to the left-hand side of the name satisfies the DNS name part of the constraint. For example, www.host.example.com would satisfy the constraint (host.example.com), but 1host.example.com would not 🦋
examples:
Name Constraints
SRVName restriction Matching SRVName non-matching SRVName
=================== ================ ====================
example.com _mail.example.com _mail.1example.com
_ntp.example.com
_mail.1.example.com
_mail _mail.example.com _ntp.example.com
_mail.1example.com
_mail.example.com _mail.example.com _mail.1example.com
_mail.1.example.com _ntp.example.comAppendix A. ASN.1 Syntax 🧾
okay so, just like RFC 2459, the ASN.1 modules come in two different variants of the ASN.1 syntax 💖
This section describes the data objects that conforming Public Key Infrastructure (PKI) components use, written in an "ASN.1-like" syntax. It's basically a hybrid of the 1988 and 1993 ASN.1 syntaxes, where the 1988 syntax got a boost with the 1993 UNIVERSAL Type UTF8String ✨
ngl this is where it gets a little messy 🙈 The ASN.1 syntax doesn't allow type statements inside the ASN.1 module, and the 1993 ASN.1 standard doesn't allow the new UNIVERSAL types in modules that use the 1988 syntax. So this module doesn't fully conform to either version of the ASN.1 standard 💀
Appendix A.1 can be parsed by a 1988 ASN.1 parser, as long as you swap the definitions for the UNIVERSAL Types with the 1988 catch-all "ANY" 🔧
Appendix A.2 can be parsed "as is" by a 1997-compliant ASN.1 parser 🌸
If the two modules ever disagree, the 1988 module is the normative one, so that's the one you trust 👑
Appendix A.1. 1988 ASN.1 Module 🎀
PKIXServiceNameSAN88 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-dns-srv-name-88(39) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
-- UTF8String, / move hyphens before slash if UTF8String does not
-- resolve with your compiler
id-pkix
FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(18) } ;
-- from RFC3280 [N2]
-- Service Name Object Identifier and Syntax
-- id-pkix OBJECT IDENTIFIER ::= {1 3 6 1 5 5 7}
id-on OBJECT IDENTIFIER ::= { id-pkix 8 }
id-on-dnsSRV OBJECT IDENTIFIER ::= { id-on 7 }
SRVName ::= IA5String (SIZE (1..MAX))
ENDAppendix A.2. 1993 ASN.1 Module 🦋
PKIXServiceNameSAN93 {iso(1) identified-organization(3) dod(6)
internet(1) security(5) mechanisms(5) pkix(7) id-mod(0)
id-mod-dns-srv-name-93(40) }
DEFINITIONS EXPLICIT TAGS ::=
BEGIN
-- EXPORTS ALL --
IMPORTS
id-pkix
FROM PKIX1Explicit88 { iso(1) identified-organization(3)
dod(6) internet(1) security(5) mechanisms(5) pkix(7)
id-mod(0) id-pkix1-explicit(18) } ;
-- from RFC 3280 [N2]
-- In the GeneralName definition using the 1993 ASN.1 syntax
-- includes:
OTHER-NAME ::= TYPE-IDENTIFIER
-- Service Name Object Identifier
id-on OBJECT IDENTIFIER ::= { id-pkix 8 }
id-on-dnsSRV OBJECT IDENTIFIER ::= { id-on 7 }
-- Service Name
srvName OTHER-NAME ::= { SRVName IDENTIFIED BY { id-on-dnsSRV }}
SRVName ::= IA5String (SIZE (1..MAX))
ENDAuthor's Address 💌
Stefan Santesson Microsoft Tuborg Boulevard 12 2900 Hellerup Denmark
EMail: stefans@microsoft.com
Full Copyright Statement ©️
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🔐
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
📦 where this page comes from
- ietf: rfc4985 2007-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms