The bottom line is that we encourage people to select DNs that
will later be conformat to directory X.500 schema in which the
certificates may be stored.
This is my annual reminder that X.500 directories are as inevitable as
TP4 replacing TCP. And for largely the same reasons.
Steve did say "may be stored" rather than "will be stored"; we're getting
somewhere. Now if we could enact a standard for DNS email addresses
in PEM certs, we'd really be making progress.
Consider the advantages -- we wouldn't have to argue over which
attributes do what. I was going to put a smiley there, but it occurs
to me that this is serious. Part of the reason X.500 certs are
inappropriate for PEM is exactly because they are so ill-defined. We
all know exactly what a DNS email address means.
John