My comments apply to sections 3.3.1 and 3.3.2 of the Device API Policy Framework document (http://dev.w3.org/2009/dap/policy/) and are motivated by the requirement to be able to identify individual web applications by the Subject attributes. This is needed for specific use cases. See http://lists.w3.org/Archives/Public/public-device-apis/2010Apr/0084.html.
I understand your points about the certificate's subject field. However, I mean that it would be possible to create a parser even though the fields within subject are order independent and may change. I mean that the configured policy could define the parts of the subject field that are needed for a full identification of the web application. For example, if Common Name is enough then the subject field only contains Common Name and only Common Name is used in the comparison with the certificate. If both Common Name and Organization is needed then both these fields are included in the configured policies subject field. For example: "CN=www.freesoft.org/emailAddress=baccala@freesoft.org O=Brent Baccala".
This would give a flexible solution and give the possibility to have an identification with a fine granularity when this is needed.
What I basically say is that it is not enough to state root certificate attributes, server certificate attributes are also needed. Furthermore I think that we have a terminology confusion. Isn't the commonly used term for a site's certificate "server certificate"? However, in 3.3.2 it is called "site certificate" and 3.3.1 refers to "distributor". I suggest a consistent naming.
key-server-subject: The subject field of the server certificate. Empty bag if none.
key-server-fingerprint: The fingerprint of the server certificate. Empty bag if none.
Doesn't the hash-method need to be stated?
> a more flexible identification of a widget resource?
> which could potentially be a problem.
> name" for the root certificate.
> Agree in the case of the root certificate.
> certificate chained to by the site certificate. Empty bag if none.
> the site certificate and the server certificate?
> Do you mean "server certificate"?
Next message: Alissa Cooper: "Sys Info network attributes"
In reply to: Arribas, Laura, VF-Group: "RE: [Policy] [ACTION-152] Editor Updates to Policy Requirements and Policy Framework"