Internet X.509 Public Key Infrastructure Subject Alternative Name for Expression of Service Name
Extracted elements (15)
The protocol component (_Service._Proto.Name from RFC 2782 SRV RR) is intentionally omitted from SRVName. This allows one certificate with a single SRVName to cover multiple protocol alternatives, and significantly simplifies name constraints processing rules.
DNS name restrictions for SRVName follow subdomain matching: any DNS name formed by adding subdomains to the left-hand side of the constrained name satisfies the DNS part of the constraint (e.g., www.host.example.com satisfies host.example.com, but 1host.example.com does not).
Implementations MUST allow for increased space requirements for IDNs. An IDN ACE label begins with the four additional characters 'xn--' and may require as many as five ASCII characters to specify a single international character.
A present SRVName in a certificate MUST NOT be used to identify a host unless use of this name form is specified by the security protocol being used and the service has a defined name per RFC 2782, or use is configured by local policy.
Conforming implementations MUST convert internationalized domain names to ASCII Compatible Encoding (ACE) format as specified in RFC 3490 section 4 before storage in the Name part of SRVName. The AllowUnassigned flag SHALL NOT be set, UseSTD3ASCIIRules SHALL be set, and each label SHALL be processed with ToASCII.
Implementations SHOULD convert IDNs to Unicode before display, performing the RFC 3490 section 4 conversion with AllowUnassigned unset, UseSTD3ASCIIRules set, and each label processed with ToUnicode.
Name constraining MAY be applied to the SRVName by adding name restrictions in the name constraints extension in the form of an SRVName. Restrictions can be expressed as a complete SRVName, just a service name, or just a DNS name.
The SRVName, if present, MUST contain a service name and domain name in the form '_Service.Name', and the content MUST be consistent with the corresponding SRV RR definition in RFC 2782.
When comparing DNS names for equality, conforming implementations MUST perform a case-insensitive exact match on the entire domain name. When evaluating name constraints, implementations MUST perform a case-insensitive exact match on a label-by-label basis.
Name constraints matching for SRVName handles the service name part and DNS name part separately. A service name restriction can only be satisfied by an SRVName with a matching service name; an absent service name restriction is satisfied by any SRVName matching the domain part.
SRVName is defined as an otherName form within the GeneralName structure of the X.509 SubjectAltName extension. It is an IA5String with OID id-on-dnsSRV (id-on 7), encoding a service name and domain name in the form '_Service.Name'.
This document registers the OID id-on-dnsSRV ::= { id-on 7 } under the id-on arc ({ id-pkix 8 }) for the SRVName otherName form in X.509 SubjectAltName extensions.
Assignment of services to hosts may change over time. Implementers must ensure old certificates that no longer reflect current service assignments are revoked and all issued certificates are kept up to date.
When X.509 certificates with the SRVName name form are used to enhance authentication of SRV RR-based service discovery, all security considerations of RFC 2782 apply.
SRVName is encoded as an IA5String (SIZE 1..MAX) with OID id-on-dnsSRV ::= { id-on 7 }, where id-on ::= { id-pkix 8 }. The value format is '_Service.Name', with an underscore prepended to the service identifier.