3280bis David Cooper

Changes Since Draft 02 ● Section 1 (Introduction): Replaced text highlighting changes between RFC 2459 and 3280 with text highlighting changes between RFC 3280 and 3280bis. ● Sections and (issuer and subject): Added text about using TeletexString, BMPString, and UniversalString in names of new CAs and end entities that are joining an existing domain where those encodings are already in use  Alignment with draft-ietf-pkix-cert-utf8-03.txt

Changes Since Draft 02 ● Section (Extended Key Usage): Clarified that an application that requires the presence of an EKU extension with a particular OID is not required to accept the presence of anyExtendedKeyUsage as a match. ● Section 6.2 (Using the Path Validation Algorithm): Removed paragraph about extending path validation algorithm to conform to PEM rules.

Changes Since Draft 02 ● Added to Security Considerations text about  risks involving different strings with similar visual representations  risk of circular dependencies when using an HTTPS URI in cRLDistributionsPoints, authorityInfoAccess, or subjectInfoAccess extensions. ● Section 7 (Rules for Processing Internationalized Names): Clarified that strings are prepared as “stored” prior to comparison. ● Updated references section.

Open Issues ● Should 3280bis forbid conforming CAs from imposing name constraints on the x400Address, ediPartyName, and registeredID name forms? ● Include guidance on handling/avoiding circular dependencies in certificate status checking? ● Escape clause?